Detecting Rhadamanthys stealer: what its Windows tradecraft reveals

At a glance

What this is: Wazuh maps Rhadamanthys stealer’s Windows tradecraft to observable Temp-folder, loader, registry and DNS activity that appears before credential theft completes.

Why it matters: It matters because IAM and endpoint teams need to catch credential-harvesting behaviour while the malware is staging and probing, not after browser passwords, VPN credentials or wallet data are already gone.

Context

Rhadamanthys stealer is a Windows credential theft problem disguised as ordinary endpoint activity. It stages payloads in Temp directories, renames and executes them through batch files, and then moves quickly into discovery and exfiltration, which means traditional cleanup-first thinking misses the most useful warning signs. For identity and endpoint teams, the key issue is not just malware presence but the speed at which stolen credentials can become reusable access.

The governance gap is that many control stacks still assume malicious activity will be obvious only after a payload settles in or a user reports damage. Here, the meaningful signals appear earlier in process creation, file writes, registry persistence and DNS behaviour, so detection has to be tuned to the identity-bearing artefacts the malware touches, not just the final theft outcome.

Key questions

Q: What breaks when Windows stealer malware can stage and execute from Temp folders unchecked?

A: Temporary folders become a low-friction hiding place for payload drops, renames and script launches. When defenders do not correlate file creation, rename and parent process behaviour in that path, the malware can move from delivery to credential theft before a signature or user report appears. The control gap is visibility at the staging layer, not endpoint coverage in general.

Q: Why do process enumeration and security-tool checks matter in credential-stealing malware?

A: They show the malware is adapting before exfiltration. When a stealer runs tasklist.exe or searches for antivirus services, it is mapping the environment and trying to reduce detection risk. That makes these actions useful precursors for detection logic because they indicate the intrusion has moved beyond delivery and into active preparation for theft.

Q: How can security teams tell whether loader-based malware is still in its staging phase?

A: Look for built-in utilities, temporary working directories and unusual child processes appearing together in the same execution chain. If a benign-looking file extension, a loader, and a new batch or script path all originate from one Temp directory, the malware is usually still assembling or launching the next stage rather than completing its objective.

Q: When should teams prioritise registry cleanup and DNS anomalies during investigation?

A: Prioritise them once a temporary payload chain is confirmed, because those signals often indicate anti-forensics and control-plane activity rather than harmless noise. A RunOnce cleanup entry followed by its deletion suggests the actor is hiding its own traces, while random DNS lookups can show probing or staging. Together they narrow the window before stolen credentials are reused.

Technical breakdown

Temp-folder staging and batch execution on Windows

Rhadamanthys commonly drops a payload into a user Temp path, renames it into a batch file and executes it through cmd.exe. That sequence matters because Temp directories are noisy by design, so malware blends into ordinary installer and script activity unless defenders correlate file creation, rename, and shell execution from the same working directory. In practical terms, the observable unit is not one event but the sequence. When the same temporary path produces a new file, a rename to .bat, and immediate command execution, the risk is no longer generic suspicious activity but a staged malware chain preparing for theft or loader handoff.

Practical implication: correlate Temp-folder file creation with batch execution so the alert fires on the staging chain, not on isolated noise.

Loader abuse, obfuscation and process injection

The stealer relies on loaders, masqueraded file types and process injection to keep the next stage hidden from simple signature checks. On Windows, that often means a benign-looking file extension, a built-in utility, or a script engine is used to start the real malicious component. The architectural point is that the initial file is often just a delivery wrapper. Defenders need to watch for a loader chain that starts with one executable context and ends in another, especially when the parent-child process tree includes temporary directories, built-in utilities or script hosts that do not normally launch credential theft tooling.

Practical implication: inspect parent-child process trees and alert when built-in utilities start from temporary staging paths.

Registry cleanup and network probing as post-execution signals

Rhadamanthys also uses a RunOnce registry value for cleanup and then deletes that entry, while its loader issues DNS queries for random, non-existent domains. Those actions show two different behaviours: first, an attempt to erase local evidence of the staging directory; second, an attempt to probe or reach out using generated or junk domains. This combination is useful because it turns persistence and anti-forensics into detection opportunities. If defenders only look for known bad domains or obvious exfiltration, they miss the quieter control-plane activity that sits between infection and theft.

Practical implication: monitor RunOnce modifications and suspicious DNS lookups together, because cleanup and probing often happen before the theft is visible.

Threat narrative

Attacker objective: The attacker wants rapid reuse of stolen credentials and wallet data before the endpoint can be cleaned or the infection chain is fully observed.

1. Entry occurs through phishing emails, cracked software, malicious ads or fake installers that deliver the stealer to a Windows endpoint.
2. Credential access begins when the malware enumerates processes, checks for security tools and unpacks its next-stage payload from a temporary working directory.
3. Escalation and evasive execution continue through loader abuse, process injection and RunOnce-based cleanup designed to reduce forensic visibility.
4. Impact arrives immediately after infection as the stealer harvests browser passwords, VPN credentials, system metadata, autofill data and crypto wallet information.

Breaches seen in the wild

• CircleCI breach 2023: Malware stole a CircleCI engineer's SSO session; attackers exfiltrated customers' CI/CD secrets and keys, forcing a platform-wide rotation.
• Shai Hulud npm malware campaign: Shai Hulud campaign: npm malware exposed secrets on GitHub.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Temp-path tradecraft is a governance problem, not just a malware signature problem: Rhadamanthys shows how much malicious work can be hidden inside writable user space before a control ever sees a clear exfiltration event. That shifts the defensive burden toward correlating file, process and registry actions in the same execution chain. For IAM and endpoint teams, the practical conclusion is that credential-harvesting malware is often easier to catch at staging time than at theft time.

Endpoint telemetry now has direct identity-security value: When stealer malware targets browser passwords, VPN credentials and autofill data, it is abusing the same trust surfaces that identity programmes rely on. That makes this more than a host security issue, because stolen secrets can quickly become valid access in cloud, SaaS and remote access paths. NHI governance is relevant here because the same operational weakness appears whenever credentials are discovered too late or revoked too slowly.

Detection must move upstream of exfiltration: The article reinforces a simple but uncomfortable reality, which is that immediate exfiltration compresses the response window. If defenders wait for obvious data movement, the attacker may already have what they need. The better control question is whether the organisation can flag suspicious process trees, temporary-directory execution and registry cleanup before stolen credentials are packaged for reuse.

Anti-forensics should be treated as a signal of intent: The combination of deleted RunOnce cleanup entries and random DNS lookups is not incidental noise. It indicates the malware is trying to manage its own lifecycle and obscure attribution while remaining functional. Practitioners should treat that as evidence that the actor is optimising for repeatable access and low-friction reuse, not just one-off infection.

What this signals

Credential-harvesting malware is now a workflow problem: Rhadamanthys demonstrates that the most useful control point is often the handoff between file staging, loader execution and cleanup. When security teams can see that transition, they can interrupt the theft path before browser passwords and VPN credentials leave the endpoint.

Identity teams should treat browser and VPN secrets as high-value endpoint assets: Once a stealer reaches those stores, the malware no longer needs persistence for long to create damage. The governance lesson is that credential protection and endpoint detection have to be joined up, because stolen secrets frequently become the first reusable access path into wider environments.

Early behavioural detection beats post-compromise triage: In stealer campaigns, the gap between infection and loss can be short enough that the response must start at process creation and file staging. Practitioners should tune detection around the earliest stable signals and not wait for obvious exfiltration or user-visible account abuse.

For practitioners

• Harden Temp-directory monitoring Alert on executable creation, rename and launch activity from user Temp paths, especially when a new file becomes a batch script and immediately spawns cmd.exe or a loader chain.
• Correlate process trees with security-tool discovery Treat tasklist.exe and findstr.exe executions from the same temporary working directory as high-risk when they enumerate antivirus, antimalware or process lists.
• Detect staged loader behaviour Flag built-in utilities such as extrac32.exe and masqueraded script or screensaver files when they execute from the same transient folder as the payload.
• Monitor registry cleanup and anti-forensics Watch for RunOnce entries that call advpack.dll to delete a temporary malware directory, then alert when the same key is removed shortly afterwards.
• Use DNS anomalies as an early warning Investigate random, non-existent domain lookups from temporary loader paths as a sign that the infection is probing or staging network activity before theft completes.

Key takeaways

• Rhadamanthys stealer is a Windows-focused credential thief that relies on staging, loaders and anti-forensics to reach passwords, VPN credentials and wallet data.
• The article’s key value is the sequence it exposes: temporary-file execution, process discovery, registry cleanup and suspicious DNS behaviour can all appear before exfiltration is obvious.
• Teams that monitor staging paths, loader chains and cleanup artefacts can interrupt the attack earlier than controls that only look for data leaving the endpoint.

Key terms

• Credential harvesting malware: Malware built to discover, collect, and exfiltrate credentials from hosts, tools, and metadata services rather than simply encrypting or deleting files. It often targets tokens, keys, environment files, and password stores because those artefacts can unlock multiple downstream systems with little additional effort.
• Temp-directory staging: Temp-directory staging is a tradecraft pattern where malware places payloads in user temporary folders before renaming, unpacking, or executing them. It helps attackers blend into legitimate system activity while they prepare later stages. Defenders should treat unusual execution from Temp locations as a strong compromise signal.
• Loader Chain: A staged execution path where one component unpacks, launches or fetches the next payload instead of delivering the final malware directly. This structure helps attackers hide intent, swap payloads quickly and bypass controls that only inspect the initial file.
• Anti-Forensics: Actions taken to hide, erase, or distort evidence after risky behaviour has already begun. In insider-risk cases this often includes deletions, cleared history, vanished archives, or other cleanup meant to break attribution. Anti-forensics is important because it usually appears reactively, after the earlier behavioural signals have already emerged.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management for practitioners who need to connect identity controls to broader security operations. It helps teams align identity risk decisions with the operational realities of credential exposure, rotation and response.