Cybersecurity researchers have observed Strelastealer malware targeting hundreds of U.S. and E.U. organizations in Q1 of 2024. Strelastealer malware was first observed in November 2022 as a new form of info-stealing malware built to swipe email account credentials. At the time, Strelastealer appeared to be targeting mainly Spanish-speaking individuals based on the language of phishing emails crafted to deliver the malware via .ISO files. Since 2022, the infection chain of Strelastealer has evolved. The newer version uses ZIP attachments instead of .ISO files to drop an initial JavaScript file. The JavaScript in turn drops a batch file and a malicious DLL which is executed via “rundll32.exe” to deploy the payload. In addition, the new Strelastealer packer has evolved and employs a control flow obfuscation technique to make analysis of the malware more difficult. The primary goal of the malware remains the same: to steal email login credentials which can be used for subsequent attacks. Researchers note that the high-tech industry is most commonly targeted by this campaign, accounting for roughly 900 StrelaStealer samples observed by researchers. CTIX analysts recommend blocking all Indicators of Compromise (IOCs) associated with the Strelastealer (linked in the report below). CTIX analysts will continue to report on evolving and novel strains of malware and associated campaigns.