SHUYAL Emerges: Stealing Login Credentials from 19 Major Browsers

A sophisticated new information stealer named SHUYAL was recently discovered by Hybrid Analysis.

It has demonstrated extensive capabilities in credential extraction from 19 different web browsers, including popular ones like Google Chrome, Microsoft Edge, Opera, Brave, and Yandex, as well as more specialized ones like Opera GX, Vivaldi, Chromium, Waterfox, Tor, Epic Privacy Browser, Comodo Dragon, Slimjet, Coc Coc, Maxthon, 360 Secure Browser, UR Browser, Avast Secure Browser, and Falkon.

Named after unique identifiers in the executable’s PDB path, which also references a “sheepy” username, SHUYAL represents a previously undocumented threat that integrates comprehensive browser targeting with advanced system reconnaissance.

Advanced Capabilities in Credential Theft

The malware performs detailed enumeration of hardware components, retrieving models and serial numbers of disk drives via WMIC commands, alongside descriptions and device IDs for keyboards, pointing devices like mice, and desktop monitors.

This reconnaissance extends ...