Lucid Stealer — Node.js-Wrapped Windows Infostealer with Hidden Remote Access (HVNC)
Lucid Stealer (TL-2026-0721), also tracked as Lucid, is a high-severity malware campaign, first published 2026-06-08. It is attributed to Lucid Stealer operators with low confidence, affects Microsoft Windows, maps to 20 MITRE ATT&CK techniques (T1005, T1027, T1036.005), and is covered by 9 detection rules and 18 indicators of compromise.
Key facts for TL-2026-0721
- Threat ID
- TL-2026-0721
- Also known as
- Lucid, LucidPay
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-06-08
- Last reviewed
- 2026-06-08
- Attribution
- Lucid Stealer operators
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- consumer, gaming, cryptocurrency, technology
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 18
Malware and tooling in Lucid Stealer
Malware and tooling: Lucid Stealer, Lucid multi-tenant web panel (Telegram MaaS)
Lucid Stealer is a subscription-sold (MaaS) Windows infostealer wrapped inside a legitimate Node.js Single Executable Application (SEA) runtime for evasion. It steals credentials, cookies, autofill and history from 18 browsers; runs a clipboard crypto-clipper across 21 address formats; loots 7 desktop wallets, 7 wallet browser extensions, 4 Discord client variants, and Roblox session data; and pairs theft with live remote access via a hidden HVNC desktop-control module, remote shell, file manager, keylogger, and screenshot/stream capture.
How Lucid Stealer works
Lucid Stealer is a commercial Windows infostealer-plus-RAT analyzed by the Foresiet Threat Intel Team and reported publicly on 2026-06-08. It is distributed as a ~100 MB password-protected WinZip-AES archive containing a Windows x64 Node.js Single Executable Application (SEA). The SEA wrapping bundles a legitimate, signed Node.js runtime around a malicious NODE_SEA_BLOB JavaScript loader (~8.5 MB), allowing the payload to ride a trusted interpreter and evade signature- and reputation-based defenses.
The embedded JavaScript core is protected with an RC4-style PRGA keystream and an additional XOR pass. Once decoded, it drops and invokes a set of native Node addons staged under %LOCALAPPDATA%\Common\<id>\*.node: a bundled SQLite CLI for querying copied browser databases, a native elevation addon for privilege-escalation attempts, an HVNC addon for hidden virtual desktop / remote-screen control, RobotJS for synthetic input and screen capture, and a canvas image module for rendering screenshots and live streams.
Data theft is broad. Lucid harvests saved credentials, cookies, autofill, and history from 18 Chromium- and Gecko-based browsers; injects into and continuously exfiltrates from 4 Discord client variants; loots 7 local desktop wallets and 7 wallet browser extensions; reads Roblox session data; and runs a clipboard monitor that swaps copied cryptocurrency addresses against 21 supported formats (crypto-clipping). Staged loot is written to %TEMP%\Data_<hwid>.zip before exfiltration.
Persistence is established through an HKCU\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate registry value pointing at a hidden self-copy named %TEMP%\winupd_<random>.exe. Command and control runs over HTTP/WebSocket to 45.138.16.107:3001 and associated domains (lucidstealer.one, iloveyoulucid.space, 0kt.one) using /upload, /internal/log, /dc-injector, and /ws endpoints. Beyond theft the operator panel exposes live remote shell, file-manager operations, keylogging, hidden desktop control, and DDoS commands.
Lucid is sold as Malware-as-a-Service through a Telegram channel backed by a multi-tenant hosted web panel and per-customer license keys, with operator-branding strings such as "LUCIDPay" and "_LUCID*" variables. Operators briefly paused in late May 2026 and relaunched with a full site rebuild, announcing a planned migration from Node.js to Java for improved evasion — making this an active, evolving threat where behavioral hunting outperforms hash-based detection.
MITRE ATT&CK techniques used in TL-2026-0721
Collection
T1005 Data from Local System; T1113 Screen Capture; T1115 Clipboard Data; T1560.001 Archive Collected Data: Archive via Utility
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information
Exfiltration
T1041 Exfiltration Over C2 Channel
Credential Access
T1056.001 Input Capture: Keylogging; T1539 Steal Web Session Cookie; T1555.003 Credentials from Password Stores: Credentials from Web Browsers
Execution
T1059.007 Command and Scripting Interpreter: JavaScript; T1204.002 User Execution: Malicious File
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1573.001 Encrypted Channel: Symmetric Cryptography
Impact
T1498 Network Denial of Service; T1657 Financial Theft
Persistence
T1547.001 Registry Run Keys / Startup Folder
Privilege Escalation
T1548 Abuse Elevation Control Mechanism
Initial Access
Affected products and versions in Lucid Stealer
- Microsoft — Windows
Vulnerable versions: 10 x64; 11 x64 - Google — Chrome / Chromium browsers
Vulnerable versions: all - Mozilla — Firefox / Gecko browsers
Vulnerable versions: all - Discord — Discord desktop (4 client variants)
Vulnerable versions: all
Remediation for Lucid Stealer
Immediate actions
- Block C2 IP 45.138.16.107 and domains lucidstealer.one, iloveyoulucid.space, 0kt.one at perimeter and DNS
- Hunt for HKCU Run value 'WindowsUpdate' pointing to %TEMP%\winupd_*.exe and remove
- Treat any host that executed the payload as fully compromised — rotate all browser-saved credentials, Discord tokens, and crypto wallet keys
- Quarantine %TEMP%\Data_<hwid>.zip staging archives and %LOCALAPPDATA%\Common\<id>\*.node addons
Workarounds
- Block execution from %TEMP% and %LOCALAPPDATA%\Common via WDAC/AppLocker
- Disable clipboard access for untrusted processes where feasible
Longer-term hardening
- Deploy EDR with behavioral detection for Node.js SEA executables spawning from user-writable paths
- Alert on unexpected node.exe / *.node addon loads accessing browser credential stores
- Move crypto users to hardware wallets to defeat clipboard clipping and key theft
- Application allowlisting to block unsigned/oversized Node.js SEA binaries from TEMP
Timeline of Lucid Stealer
- Lucid Stealer operators briefly suspended operations on their Telegram channel ahead of a site rebuild.
- Operators relaunched with a full rebuild of the hosted web panel and announced a planned migration from Node.js to Java for improved evasion.
- Foresiet Threat Intel Team statically analyzed a newly observed Lucid Stealer Node.js SEA build promoted via Telegram-linked underground channels.
- C2 endpoint 45.138.16.107:3001, associated domains, payload hashes, and persistence artifacts published for defender hunting.
- Public reporting of Lucid Stealer capabilities, IOCs, and C2 infrastructure by Cyber Security News and GBHackers.
Sources cited for Lucid Stealer
- New Lucid Stealer Targets 18 Browsers, Crypto Wallets, and Discord Tokens With Hidden Remote Access
- Lucid Stealer Hits 18 Browsers, Crypto Wallets, and Discord Tokens
- Foresiet Threat Intel — Stealer Operations and Threat Landscape
- FortiGuard Labs — Stealit Campaign Abuses Node.js Single Executable Application
- Zscaler ThreatLabz — NodeLoader Node.js Malware Evading Detection
Threats related to Lucid Stealer
- SolyxImmortal Python Infostealer — Chromium/Firefox Credential & Cookie Theft, Keylogging, Discord Webhook Exfiltration (Turkish-Speaking Actor)
- Vanta Stealer — Python-Based Cross-Platform Information Stealer Using Layered PyArmor Obfuscation
- Remus Stealer: 64-bit Lumma-Derived Infostealer-as-a-Service with EtherHiding Blockchain C2 and Application-Bound Encryption Bypass
- CrashStealer: Notarized Fake Apple CrashReporter App Steals macOS Keychain, Browser, and Crypto Wallet Credentials
Detection coverage for TL-2026-0721
As of 2026-06-08, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0721 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.