Cybersecurity analysts at G DATA first identified the threat in April 2025. The malware uses a multi-step attack method that begins with a Google Drive document and ends with the theft of sensitive data.
How the Attack Works
The attack starts when a victim opens a Google Drive document containing an obfuscated PowerShell script. Once executed, the script bypasses PowerShell security policies and loads a Base64-encoded second-stage script.
This script sets up persistence by creating a scheduled task named f90g30g82, which runs every minute. It searches the system’s Recent Files folder for special marker files with a .normaldaki extension.
If such a file is found, the malware contacts a command-and-control (C2) server at cdn.findfakesnake[.]xyz to download further payloads. If the primary server is unreachable, it switches to a backup server at cat-watches-site[.]xyz.
Payload and Data Theft
The final payload is a .NET assembly downloaded from flowers.hold-me-finger[.]xyz. It is loaded directly into memory using reflection techniques to avoid detection.
The malware, named Chihuahua Stealer, collects browser credentials, cookies, and cryptocurrency extension data. The stolen data is encrypted using AES-GCM and stored in a .chihuahua archive before being sent over HTTPS.
Advanced Evasion Techniques
Chihuahua Stealer uses several techniques to avoid detection. It flushes DNS caches and clears the clipboard after execution. It also creates a unique victim ID using the machine’s name and disk serial number to tag stolen data.
Security researchers noted the use of Windows Cryptography API: Next Generation (CNG) for encryption. Although this makes decryption difficult, embedded AES keys were recovered during analysis.
Detection and Recommendations
G DATA recommends monitoring PowerShell logs for unusual scheduled tasks and checking for in-memory .NET assemblies. Indicators of compromise (IOCs) include suspicious URLs such as:
- hxxps://flowers[.]hold-me-finger[.]xyz/index2[.]php
- Hashes related to PowerShell and payload components (e.g.,
afa819c9...,c9bc4fdc...)
The malware is detected under signatures such as PowerShell.Trojan-Downloader.Agent.IE1KHF and Win32.Trojan-Stealer.Chihuahua.8W7FOE.
Organizations are advised to restrict PowerShell execution policies and scan for marker files like .normaldaki. As malware increasingly uses cloud platforms for delivery, users should avoid opening unsolicited documents or links.
