Fake RODECaster Website Distributes Node.js Santa Stealer Malware to Windows Users
Palo Alto Networks Unit 42 researchers uncovered a search engine poisoning campaign that uses a fake audio software portal to distribute Santa Stealer malware. Visitors searching for RODECaster utilities land on a newly registered lookalike domain that serves a Node.js executable disguised as an official Windows installer. Once launched, the RODECaster Santa Stealer malware harvests logins from 24 web browsers, backdoors Discord clients, steals cryptocurrency wallets, and drops a second-stage executable.
On November 5, 2026, Unit 42 researchers Somil Tyagi and Alex Payne documented a malvertising and search engine optimization lure targeting audio producers and streamers. According to the Unit 42 threat intelligence advisory, “We observed search engine results directing users to a fraudulent website impersonating RODECaster software to distribute Santa Stealer malware.” Specifically, users querying search engines for “rodecaster software” were routed to a newly registered .net domain mimicking the legitimate RODE Microphones download page. That fake site served a compressed archive named RODECaster_App_WIN.zip containing a malicious 64-bit executable.
Linha do tempo
-
Fake RODECaster Website Distributes Node.js Santa Stealer Malware to Windows Users
ler a análise desta fonte ocultar
Palo Alto Networks Unit 42 researchers uncovered a search engine poisoning campaign that uses a fake audio software portal to distribute Santa Stealer malware. Visitors searching for RODECaster utilities land on a newly registered lookalike domain that serves a Node.js executable disguised as an official Windows installer. Once launched, the RODECaster Santa Stealer malware harvests logins from 24 web browsers, backdoors Discord clients, steals cryptocurrency wallets, and drops a second-stage executable.
On November 5, 2026, Unit 42 researchers Somil Tyagi and Alex Payne documented a malvertising and search engine optimization lure targeting audio producers and streamers. According to the Unit 42 threat intelligence advisory, “We observed search engine results directing users to a fraudulent website impersonating RODECaster software to distribute Santa Stealer malware.” Specifically, users querying search engines for “rodecaster software” were routed to a newly registered .net domain mimicking the legitimate RODE Microphones download page. That fake site served a compressed archive named RODECaster_App_WIN.zip containing a malicious 64-bit executable.