SantaStealer Malware: A New Holiday-Themed Infostealer Targeting Business Credentials

Not a scan of your files - a targeted sweep of the exact places browsers and apps stash credentials and live sessions.

An infostealer harvests three things that matter most to a business: saved browser credentials, active session tokens and cookies, and cryptocurrency wallet data - then packages them and sends them to an attacker, often within seconds of running.

SantaStealer is built as a modular, multi-threaded stealer, which is a fancy way of saying it runs a set of small jobs at once, each aimed at a different data store. Rapid7 counted 14 stealing modules. According to Rapid7, the collected data is zipped, split into 10 MB chunks, and sent to attacker servers over plain HTTP. In practice, the categories below are what turn one infected laptop into a business-wide problem.

• Saved browser passwords and autofill. Chrome and Edge store logins, addresses, phone numbers, and card details. A stealer copies that vault straight off the disk - which is why "save password?" is a business risk, not a convenience.
• Session cookies and tokens. These keep you logged into email, banking, and SaaS without re-entering a password. Steal a live session and an attacker can ride it into the account, sometimes without triggering MFA at all.
• Cryptocurrency wallets. The stealer scrapes wallet addresses, private keys, and seed phrases. Any business holding digital assets can lose them with no way to reverse the transfer.
• App and messaging data. Telegram, Discord, and Steam session data get pulled - useful for account takeover and for reaching further into a company through a trusted account.

Seven controls that close the credential-theft paths infostealers depend on. Put these in place and a stolen laptop stops being a stolen company.

Infostealer malware protection comes down to a credential-theft defense checklist: phishing-resistant MFA and passkeys, session-token protections, EDR on every device, browsers that do not store passwords, fast patching, blocked malvertising and fake-verification lures, and a team trained to spot them.

• Move to phishing-resistant MFA and passkeys. Push-approval MFA still helps, but passkeys and FIDO2 security keys are bound to the real site and cannot be replayed from a stolen session the way a reused cookie can. Turn them on for email, banking, and admin accounts first.
• Protect the session, not just the login. Enable token-binding and conditional-access features in Microsoft 365 or Google Workspace so a session cookie stolen off one device is rejected from an attacker's machine. Shorten session lifetimes on high-value apps.
• Run EDR on every endpoint. Infostealers like SantaStealer try to operate in memory to dodge signature antivirus. Behavior-based endpoint detection and response is what flags a process reading the browser credential store and beaconing out.
• Stop storing passwords in the browser. Move the team to a dedicated password manager and turn off Chrome and Edge password saving by policy. If the browser vault is empty, the module built to steal it comes back with nothing.
• Patch browsers and operating systems on a schedule. SantaStealer ships a bypass for a mid-2024 Chrome encryption feature; an out-of-date browser is a wider door. Keep Chrome, Edge, Windows, and applications current automatically.
• Block the delivery paths. Infostealers arrive through malvertising, pirated software, game cheats, and fake "verify you are human" prompts that tell users to paste a command. Filter DNS and web traffic, restrict software installs, and block script-paste lures.
• Train the team on fake verification and support scams. The human element is still the trigger. Staff who recognize a bogus CAPTCHA or a fake IT-support instruction to run a command are the control that stops the infection before any module runs.

A malware-as-a-service model means the buyer does not need skill - just a target with saved passwords and no one watching the endpoints.

Houston small businesses are prime targets because the malware-as-a-service model lets any buyer, skilled or not, rent SantaStealer for a few hundred dollars a month and aim it at firms that store passwords in browsers and lack full-time security staff.

The rental price is the point. When a working infostealer costs less than a monthly software subscription, the attacker pool stops being elite hackers and becomes anyone with a credit card and a grudge. That widens exposure for the businesses that make up the Houston metro: professional-services firms holding client data, medical practices where a stolen login is also a HIPAA problem, and energy-services companies whose credentials can reach into larger partner and infrastructure networks. None of those firms usually run a security operations center. That gap - valuable credentials plus thin monitoring - is exactly the soft target the malware-as-a-service model is priced to hit.

Here is the local reality. A stolen session token from a Katy CPA practice or a Sugar Land law office is not a nuisance; it can be the front door to client tax records, escrow instructions, or privileged case files. The defense checklist above is affordable for a 10 to 200 person firm precisely because most of it is configuration and monitoring, not a pile of new products - which is what a local managed IT partner sets up and keeps running.

CinchOps is a managed IT services provider based in Katy, Texas, serving small and mid-sized businesses across the Houston metro area.

CinchOps specializes in cybersecurity, network security, managed IT support, VoIP, and SD-WAN for businesses with 10-200 employees. Against infostealers like SantaStealer, that means the checklist above set up correctly and kept running:

• Identity and session hardening. Phishing-resistant MFA and passkeys enforced on the accounts that matter, plus conditional access that rejects a stolen session from an unknown device.
• EDR and endpoint control. Behavior-based detection on every device, watched around the clock, to catch a stealer reading the credential store before data leaves the building.
• Browser and password hygiene. Browser password storage turned off by policy and a business password manager rolled out, so the vault a stealer targets is empty.
• Filtering, patching, and training. DNS and web filtering to block malvertising and fake-verification lures, scheduled patching for browsers and systems, and training so the team spots the trick that starts an infection.

We serve businesses across the Houston area, including Houston, Katy, and Sugar Land, and we know what a law firm, CPA practice, or energy-services firm stands to lose when a single set of credentials walks out the door. You do not need to know whether SantaStealer specifically is on your network to take this seriously - the controls that stop it are the same ones that stop the next stealer with a different name. If you run a small business in the Houston metro, talk to CinchOps for a security assessment and a clear read on which of these controls you are missing.