Fake RODECaster Website Distributes Node.js Santa Stealer Malware to Windows Users
Do Son 
Image: Unit 42
TL;DR
Palo Alto Networks Unit 42 researchers uncovered a search engine poisoning campaign that uses a fake audio software portal to distribute Santa Stealer malware. Visitors searching for RODECaster utilities land on a newly registered lookalike domain that serves a Node.js executable disguised as an official Windows installer. Once launched, the RODECaster Santa Stealer malware harvests logins from 24 web browsers, backdoors Discord clients, steals cryptocurrency wallets, and drops a second-stage executable.
Delivery and Attribution
On November 5, 2026, Unit 42 researchers Somil Tyagi and Alex Payne documented a malvertising and search engine optimization lure targeting audio producers and streamers. According to the Unit 42 threat intelligence advisory, “We observed search engine results directing users to a fraudulent website impersonating RODECaster software to distribute Santa Stealer malware.” Specifically, users querying search engines for “rodecaster software” were routed to a newly registered .net domain mimicking the legitimate RODE Microphones download page. That fake site served a compressed archive named RODECaster_App_WIN.zip containing a malicious 64-bit executable.
Confirmed Versus Suspected Attribution
Confirmed attribution to a specific named cybercrime group does not exist for this campaign. However, confirmed technical markers inside the exfiltration messages identify the payload as Santa Stealer, an information-stealing toolset promoted on underground channels under the handle @Santagrabber and linked by independent researchers at CryptoLek to a web panel introduced in early 2026. Suspected attribution points to a financially motivated affiliate renting the stealer to harvest gaming, social media, and cryptocurrency accounts. Furthermore, the presence of a secondary webhook proxy suggests the operation may use a dual-hook mechanism that copies stolen logs to the core developer. Researchers did not disclose the total number of infected systems.
Infection Chain
When a victim extracts and runs RODECaster_App_WIN.exe, they launch a 64-bit Windows executable compiled with Microsoft Visual C++ that bundles the Node.js v18.5.0 runtime and the V8 JavaScript engine via the pkg bundler. As the researchers noted, “The executable is a Node.js runtime compiled into a standalone Windows binary via the pkg bundler, embedding obfuscated Santa Stealer (@Santagrabber) code.” Inside the binary, a prelude script loads a Gzip-compressed payload from a fixed byte offset.
Obfuscation and Anti-Analysis Checks
To hinder reverse engineering, the embedded JavaScript uses control-flow flattening and a three-stage string obfuscation routine built around a 5,655-element Base64 rotation array. The script also checks for function and regular-expression prototype tampering to detect debuggers. Next, it creates a lockfile named __santa_stealer_mutex__.lck inside the local temporary folder and sets the custom environment variables (__santa_elevated, __santaRun, and __santa_started) so the payload does not infect the same host twice.
Command-and-Control and Data-Exfiltration Behavior
Once active, the Santa Stealer malware targets SQLite databases across 24 Chromium-based browsers, including Chrome, Edge, Brave, Opera GX, Vivaldi, and Yandex. It decrypts legacy DPAPI-protected AES-256-GCM passwords (marked with a v10 prefix) and modern App-Bound Encryption ChaCha20-Poly1305 values (marked with a v20 prefix) by calling Windows Cryptography Next Generation APIs under administrator privileges. For Mozilla Firefox, the malware loads the native nss3.dll library to decrypt saved logins and cookies directly.
In addition, the stealer targets specific session cookies for Instagram, Roblox, and Tellonym, copies local wallet folders for Exodus and Phantom, and runs a synchronous PowerShell command to capture desktop screenshots. Worse still, the RODECaster Santa Stealer malware scans four Discord client builds for encrypted tokens and modifies the local Electron app.asar archive. That injected JavaScript hook intercepts login requests, multi-factor authentication codes, WebSocket QR logins, and Braintree or Stripe payment data whenever the victim uses Discord.
To exfiltrate the stolen data, the malware uploads compressed log.zip archives to the legitimate file-hosting services Catbox and GoFile. It then sends summary reports and download links to an operator Discord webhook alongside a secondary proxy domain. Finally, the script checks an internal environment flag before reaching out to a staging domain to download and run a secondary Windows executable.
Defense and Detection Guidance
Audio creators and everyday Windows users should download device drivers and companion apps only from verified manufacturer domains, such as rode.com, and avoid clicking top search results for hardware utilities. Security teams can detect the RODECaster Santa Stealer malware by monitoring for the __santa_stealer_mutex__.lck file in temporary directories and alerting on unsigned binaries that load embedded Node.js v18.5.0 runtimes.
Network defenders should also block outbound connections to the fake RODECaster domain, the secondary payload server, and unapproved file-hosting APIs like Catbox and GoFile. If a workstation is compromised, administrators must isolate the host, perform a clean reinstallation of Discord to purge the persistent app.asar hook, revoke active browser and Roblox sessions, and rotate all stored passwords, payment methods, and cryptocurrency wallet seed phrases from a clean computer.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
