Maranhão Stealer shows how infostealers evade detection on Windows

At a glance

What this is: This is a Windows malware detection analysis showing how Maranhão Stealer hides, fingerprints hosts, and persists while targeting browser credentials, cookies, wallets, and other sensitive data.

Why it matters: It matters because the detection pattern blends endpoint evasion with credential theft, so defenders need visibility into process behaviour, registry persistence, and suspicious PowerShell or WMIC activity, not just file signatures.

Context

Maranhão Stealer is an infostealer campaign, not just a single malware sample, and its value to defenders lies in the way it combines social engineering, loader obfuscation, and post-infection reconnaissance on Windows. The core governance gap is simple: once a user runs a trojanised installer, endpoint controls must spot behaviour that looks ordinary in isolation but is malicious in sequence.

For identity and access teams, the real risk is credential and secret exposure after initial compromise. Browser sessions, cookies, and wallet data are high-value identity assets, and once stolen they can be reused to bypass MFA, impersonate users, or pivot into SaaS and internal systems. The malware pattern is typical of modern infostealers that trade stealth for speed.

Key questions

Q: What breaks when an infostealer hides behind ordinary Windows installer activity?

A: Traditional file-signature detection breaks because the malware can arrive through a trusted-looking installer and then switch to behavioural camouflage. Security teams need to correlate process ancestry, image loads, hidden attributes, and registry persistence to detect the chain. If those signals are not joined up, the malware can steal credentials before the endpoint is clearly marked hostile.

Q: Why do browser cookies and stored credentials make infostealers an identity problem?

A: Cookies and stored credentials can act like session-bearing identity artefacts, so theft is not limited to a local device compromise. An attacker may reuse them to bypass login friction, impersonate users, or pivot into SaaS and internal systems. That is why infostealer events should trigger credential rotation, session revocation, and review of exposed access paths.

Q: What are the signs that a Windows endpoint is being used for infostealer persistence?

A: Look for new Run key entries, hidden-system attribute changes, suspicious updater-style executables, and host-enumeration commands such as WMIC or PowerShell volume queries. These signals matter most when they appear together after a trojanised installer or cracked application has run. A single signal may be noisy, but the sequence is highly suspicious.

Q: How should security teams respond when credentials are stolen from infostealer infections?

A: They should treat the exposed secret as an active access path, not a hygiene issue. Revoke the credential, rotate dependent secrets, check every application the identity can reach and confirm whether the same credential was reused elsewhere. Fast containment matters more than perfect attribution because valid access is usually the attacker’s advantage.

Technical breakdown

Double .tmp loaders and reflective DLL injection

Maranhão Stealer uses a double .tmp file path pattern and loads isdecmp.dll as part of a reflective DLL injection chain. Reflective loading means the DLL is mapped and executed in memory in a way that reduces reliance on standard file-based loading signals, which weakens simple reputation or path-based detection. The .tmp disguise also helps the malware blend into noisy application and installer activity. On Windows, this creates a detection problem where the initial process may look disposable, but the memory-resident module carries the malicious logic. Defenders need process ancestry, image-load telemetry, and path pattern correlation to spot the chain.

Practical implication: Detect the loader chain, not just the payload filename, and alert on suspicious .tmp execution paired with unusual module loads.

Persistence, hiding, and host fingerprinting on Windows

After execution, the malware establishes persistence by creating a Run key entry named updater, then hides artefacts with attrib.exe +h +s so files are less visible in normal browsing and casual triage. It also fingerprints the host with WMIC and PowerShell queries for UUID, disk, GPU, and product-key data. That combination matters because persistence keeps the infostealer alive after a reboot, while fingerprinting helps the operator tailor collection or decide whether the host is worth deeper exploitation. This is a common Windows malware pattern: establish a launch point, reduce visibility, then enumerate the machine for context.

Practical implication: Monitor registry Run keys, hidden-system attribute changes, and host-enumeration commands as a linked behavioural sequence.

Credential harvesting and data-exfiltration pressure

Infostealers win by collecting identity-bearing data quickly, then moving it off the endpoint before the user or defender reacts. In this case, browser credentials, cookies, and cryptocurrency wallets are the primary targets, with system discovery used to widen the loot set. Because cookies can function as session artefacts and credentials can unlock cloud or SaaS accounts, the impact extends beyond the infected workstation. This is why endpoint malware should be treated as an identity event when it reaches session material or browser-stored secrets: the downstream risk is not only local compromise but account takeover and lateral abuse.

Practical implication: Treat any confirmed infostealer event as potential credential compromise and revoke affected sessions and secrets immediately.

Threat narrative

Attacker objective: Steal usable credentials and session data from Windows endpoints and convert the infected machine into a source of reusable identity artefacts and exfiltrated loot.

1. Entry occurs when a victim installs a cracked game launcher or pirated software bundle that silently drops Maranhão Stealer on Windows.
2. Credential access follows as the malware collects browser credentials, cookies, wallets, and registry-stored data while fingerprinting the host for more valuable targets.
3. Impact is credential theft and data exfiltration, with stolen session material capable of enabling account takeover and further access beyond the infected endpoint.

Breaches seen in the wild

• Shai Hulud npm malware campaign: Shai Hulud campaign: npm malware exposed secrets on GitHub.
• CircleCI breach 2023: Malware stole a CircleCI engineer's SSO session; attackers exfiltrated customers' CI/CD secrets and keys, forcing a platform-wide rotation.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Windows infostealers are identity incidents before they are endpoint incidents. Maranhão Stealer targets browser credentials, cookies, and wallet data, which means the real blast radius sits in identity reuse and session theft rather than the infected host alone. The endpoint is only the collection point; the business risk appears when stolen artefacts are replayed against SaaS, cloud, and internal access paths. Practitioners should therefore treat infostealer detection as a trigger for identity containment, not just device cleanup.

Behavioural detection is the only credible defence when malware blends into ordinary Windows activity. The article's use of double .tmp paths, registry Run keys, hidden attributes, WMIC, and PowerShell is a reminder that signature-only controls will miss campaigns that rotate packaging but keep the same operational pattern. Loader masquerade: a disposable-looking file name can hide a reflective injection chain that matters more than the payload hash. Practitioners should map detection to behaviour clusters, not isolated indicators.

Endpoint malware governance now overlaps with NHI governance. Once a stealer captures cookies or browser-stored credentials, the compromised artefact behaves like a reusable non-human identity because it can authenticate without a user present. That creates a lifecycle problem for secrets and session material: discovery, use, exposure, and revocation all need ownership. Teams that still treat credentials as a static asset are underestimating how quickly infostealers turn them into operational access.

Wazuh's value here is not just detection, but control validation. The article shows how Sysmon, custom rules, and SCA can test whether suspicious artefacts and persistence paths exist on the endpoint. That matters because defenders need both runtime alerts and post-compromise assurance that malware files, registry entries, and launch points are absent. For practitioners, the question is whether current telemetry can prove that identity-bearing artefacts were contained, not merely that malware was seen.

Attackers are optimising for speed, so the governance model must optimise for revocation. Infostealers do not need long dwell time if they can steal enough credentials in a short window to monetise access elsewhere. The control question shifts from perfect prevention to rapid exposure reduction across endpoints, browsers, and session stores. Practitioners should design for fast invalidation of stolen identity material, because the malware already assumes reuse is the easiest path to value.

From our research library:

• 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec.
• Read next: Guide to the Secret Sprawl Challenge

What this signals

Loader masquerade is the key operational signal. Threat teams should watch for disposable-looking file paths, reflective DLL loading, and autorun persistence in the same execution chain, because that combination usually means the endpoint is being prepared for theft rather than simple nuisance activity. Where browser-stored secrets are present, the priority becomes revocation of anything the malware could reuse, not only removal of the sample.

Identity recovery has to be part of endpoint recovery. A Windows infostealer that reaches browser credentials or cookies can convert endpoint compromise into account compromise with little extra effort. According to the State of Secrets in AppSec, 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, which reinforces a wider point: sensitive material is often easier to reuse than to secure once exposed.

For practitioners

• Harden Windows telemetry around infostealer behaviours Collect Sysmon process creation, image-load, registry, and PowerShell events so double .tmp execution, reflective DLL loading, and Run key persistence are visible.
• Alert on identity-bearing artefacts leaving the endpoint Treat browser credentials, cookies, wallet files, and registry-stored secrets as sensitive data that may require session invalidation and credential reset after detection.
• Detect persistence and concealment as one chain Correlate attrib.exe +h +s activity with new Run key entries and suspicious updater.exe launches, because hidden files and autorun keys often appear together.
• Use SCA to verify clean artefact state Scan for the Microsoft Updater directory, updater.exe, and crypto.key on Windows endpoints, then confirm those artefacts are absent after remediation.

Key takeaways

• Maranhão Stealer combines stealth, persistence, and host reconnaissance to turn a Windows infection into reusable credential and session theft.
• The article's detection value comes from behavioural patterns such as double .tmp execution, hidden attributes, Run key persistence, and PowerShell or WMIC enumeration.
• Defenders should treat infostealer hits as identity containment events and remove exposed secrets, sessions, and persistence artefacts together.

Key terms

• Infostealer: An infostealer is malware built to collect credentials, session material, tokens, and other authentication data from infected systems. In NHI programmes, the risk is not only theft but reuse, because harvested workload secrets can unlock cloud access long after the initial infection.
• Reflective DLL Loading: Reflective DLL loading is a technique that lets malware load a DLL into memory without using the normal Windows loader path. It reduces visibility for some controls and helps attackers run code while avoiding simple file-based detection and some traditional injection checks.
• Registry Run Key Persistence: Registry Run Key Persistence is a Windows persistence technique where malware or an unauthorized program adds itself to registry locations that launch automatically at logon or startup. Technically, attackers modify keys such as Run or RunOnce so code executes when a user signs in, helping the threat survive reboots and maintain access.
• Session Material: Session material is the data that keeps an authenticated browser session alive, such as cookies, bearer tokens, and other reusable authentication artifacts. In NHI governance, session material matters because stealing it can bypass password and MFA controls without needing the original login flow.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps security and identity practitioners connect exposure events like infostealer compromise to practical control decisions.