AuTo Stealer

Executive Summary

AuTo Stealer is a Windows credential stealer developed by SideCopy, targeting Indian and Afghan government personnel since late 2021. It harvests browser passwords, logs keystrokes, captures screenshots, and exfiltrates data via HTTPS to an adversary C2 server. The malware’s use against politically sensitive targets classifies it as a high‑risk nation‑state campaign.

AuTo Stealer is a Windows‑only malware written in C++ that has been actively used by the SideCopy threat actor since at least December 2021 to target government agencies and personnel in India and Afghanistan. The weaponization platform was uncovered by MalwareBytes, which identified it as a sophisticated credential‑stealing family that focuses on high‑profile political targets. The malware is engineered to harvest credentials from popular web browsers such as Chrome, Edge, and Firefox, while also capturing clipboard content and logging keystrokes. In addition, it can take full desktop screenshots, enumerate network shares, collect system inventory (OS version, installed applications), and persist by creating scheduled tasks or modifying registry Run keys. Collected data is exfiltrated to a command‑and‑control server over an encrypted HTTPS channel. The impact of a successful AuTo Stealer infection extends beyond the immediate loss of credentials; it provides adversaries with a foothold for lateral movement, data exfiltration, and potential sabotage within targeted institutions. Given its emphasis on government entities in politically sensitive regions, the threat is classified as a high‑impact nation‑state campaign.

Key Capabilities

• Credential harvesting from Chrome, Edge, and Firefox browsers
• Keylogging and clipboard monitoring
• Screen capture of the user’s desktop
• System inventory collection (OS version, installed software)
• Network share enumeration and file discovery
• Persistence via scheduled tasks or registry Run keys
• Exfiltration of data over encrypted HTTPS channels

ATT&CK Techniques

Recommended Actions

• Monitor for anomalous outbound HTTPS traffic to known malicious domains associated with SideCopy.
• Deploy application whitelisting to block execution of unauthorized binaries.
• Enable Windows Defender Credential Guard and monitor processes that perform credential dumping.
• Use endpoint detection & response tools to detect process injection, file monitoring and keylogging activity.
• Enforce least privilege principles on government systems to limit lateral movement.
• Apply timely patches for the OS, browsers, and security solutions to close known vulnerabilities.

Suggested Tags