New Lucid Stealer Targets 18 Browsers, Crypto Wallets, and Discord Tokens With Hidden Remote Access

A newly identified piece of Windows malware is raising serious concerns among cybersecurity professionals for its wide reach and unusually deep set of capabilities.

Discovered through underground channels linked to Telegram, the threat known as Lucid Stealer goes far beyond stealing a few stored passwords. It can take full control of an infected machine without the victim ever noticing anything is wrong.

What makes this malware particularly dangerous is how it disguises itself. The entire malicious package is wrapped inside a legitimate Node.js runtime, making it look like a normal software application to most standard security tools.

This clever packaging allows it to slip past basic defenses while quietly carrying out a wide range of harmful activities in the background.

Researchers at Foresiet identified and statically analyzed this Lucid Stealer build after noticing renewed activity tied to a dedicated Telegram channel promoting the tool as a paid, subscription-based product. 

Foresiet said in a report shared with Cyber Security News (CSN) that the sample is far more capable than a typical credential stealer, combining data theft with live remote access in a single build.

The malware is sold as a commercial service, complete with a hosted web panel, license keys, and an active support channel.

The operators briefly shut down the project in late May 2026 before relaunching it days later, announcing a full rebuild of the site and even a planned move away from Node.js toward Java for better evasion. This shows that the people behind it are actively investing in improving and expanding the threat.

The situation is especially serious because infections should be treated as full compromises. Credentials, browser cookies, Discord sessions, crypto wallet keys, and Roblox session data are all at risk the moment the malware runs.

Defenders are urged to act fast and assume everything stored on the infected machine has already been seen by the attacker.

New Lucid Stealer Targets 18 Browsers, Crypto Wallets, and Discord Tokens

Lucid Stealer is built to steal from nearly every corner of a user’s digital life. The analyzed build targets 18 browsers, 21 cryptocurrency clipper formats, seven desktop wallets, seven wallet browser extensions, and four Discord client variants.

It goes after saved credentials, session cookies, autofill data, and browser history using a bundled SQLite tool to query copied browser databases directly.

The malware injects itself into Discord clients to steal tokens and modify the app to send stolen data back continuously. It also monitors clipboard activity, so any crypto wallet address a victim copies can be silently swapped with one controlled by the attacker.

These capabilities work together to drain both financial accounts and communication platforms at the same time.

What truly sets this threat apart is its remote access module. The malware includes a hidden desktop control feature, called HVNC, that lets operators take over a machine visually without opening any visible window on the victim’s screen.

Combined with a remote shell, a file manager, keylogging, and screenshot capture, the attacker has essentially the same access as if they were sitting in front of the machine themselves.

Infection Chain and Detection Guidance for Defenders

The malware arrives in a password-protected ZIP archive. Once opened, it runs through a layered setup process that drops helper files, sets up persistence in the Windows registry, and optionally tries to gain elevated privileges.

By the time the main payload decrypts and runs, the attacker already has a stable foothold.

Security teams should focus on behavior-based detection rather than relying only on file hashes, since the operators have already announced plans to rebuild the malware on a new platform.

Hunting for temporary self-copies in the Windows TEMP folder disguised as “winupd” files, suspicious HKCU Run registry entries named WindowsUpdate, and unexpected .node module files appearing in user profiles are among the strongest signals of an active infection.

Network defenders should block all traffic to the known C2 address and watch for repeated POST requests to internal log and upload endpoints as additional confirmation.

Indicators of Compromise (IoCs)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.