SantaStealer: New Malware Hackers Rent for $175
SantaStealer: New Malware Hackers Rent for $175#### Welcome to the first Security Sunday of the new year. I hope you enjoyed the holidays, but unfortunately, hackers didn’t get a break.While we were unwrapping presents and enjoying Christmas treats, cybercriminals were hard at work.
Rapid7 Labs has identified a new sophisticated stealer called SantaStealer, which was actively promoted on Telegram in December. According to the analysis, it is a rebrand of BluelineStealer with many improvements.
The operators, who appear to be Russian citizens, are selling the stealer for prices ranging from $175 per month for basic variants up to $300 per month for premium versions.
SantaStealer boasts an impressive range of technical capabilities designed for comprehensive exfiltration of sensitive user data. The malware operates with a modular architecture that includes specialized modules for extracting credentials and cookies from web browsers, data from cryptocurrency wallets, Discord, Steam, Telegram, and as is customary with stealers, a module for capturing screenshots. The data is split into 10 MB zip files that are sent to the attacker.
The attackers behind SantaStealer have created a comprehensive web panel that provides detailed information about the malware’s capabilities, build configuration options, and pricing model. The panel also includes a feature allowing potential buyers to “scan files for malware” so the attacker can test antivirus detections before deploying the stealer.
Despite the developers’ ambitious claims, samples analyzed by Rapid7 contain unencrypted strings and function names in plaintext, references to C2 server, ChromeElevator, or a link to the authors’ Telegram, which facilitates analysis and detection.
MacSync: New Sophisticated Malware Threatens macOS Users
Security researchers from Jamf Threat Labs discovered a new variant of malicious software called MacSync Stealer in December, representing a significant evolution in malware targeting the macOS operating system. This latest version uses a digitally signed application created in the Swift programming language, allowing it to bypass Apple Gatekeeper security mechanisms. This is a fundamental shift from earlier variants that relied on less sophisticated techniques requiring user interaction with the terminal.
The malware is distributed through a file named zk-call-messenger-installer-3.9.2-lts.dmg, hosted on the domain zkcall[.]net/download. The malicious application masquerades as a legitimate zk-Call & Messenger installer. Because the application is digitally signed and has gone through Apple’s process, it can run without being blocked by built-in security controls like Gatekeeper or XProtect. After being reported, Apple revoked the certificate used to sign the application.
MacSync uses several sophisticated techniques to evade detection. The disk image is artificially inflated to 25.5 MB through embedded PDF files that are unrelated to the malware’s functionality but serve to bypass some security tools. Before executing malicious code, the application verifies internet connectivity. At the time of analysis, the sample was detected by only one to thirteen antivirus engines on the VirusTotal platform.
MacSync Stealer first appeared in April 2025 under the name Mac.C and was created by an actor operating under the alias Mentalpositive. It is a full-featured stealer based on the Go programming language that can steal credentials from iCloud Keychain, passwords stored in web browsers, system metadata, data from cryptocurrency wallets, and files from the filesystem. The malware also allows remote control of the infected computer through commands from the attacker’s server.
MacSync Stealer is part of a growing trend of sophisticated attacks on the macOS platform. Researchers warn that attackers are increasingly using signed applications to make their malware appear as legitimate software.
MongoBleed Vulnerability Threatens Thousands of Servers Worldwide
At the end of 2025, a serious vulnerability was detected in the popular MongoDB database platform, which has been nicknamed “MongoBleed”. This vulnerability, tracked as CVE-2025–14847 with a CVSS score of 8.7, allows unauthenticated attackers to remotely read sensitive data directly from the database server’s memory. According to security analysts, there are thousands of vulnerable instances worldwide, with the most affected servers in the United States, China, Germany, India, and France.
The essence of the vulnerability lies in a faulty implementation of zlib message decompression in MongoDB Server, specifically in the file message_compressor_zlib.cpp. The problem occurs when processing values in compressed protocol headers, which allows attackers to access uninitialized heap memory by sending specially crafted network packets.
The vulnerability affects all MongoDB instances with zlib compression enabled, which is unfortunately the default configuration. Security firm OX Security has warned that an attacker can gradually extract fragments of private data by sending a large number of requests.
Affected versions include MongoDB Server from v3.6.0 to the latest releases including versions 7.0.x, 8.0.x, and 8.2.x. Successful exploitation of this vulnerability can lead to the leakage of sensitive information including user credentials, passwords, API keys, and other private data stored in server memory.
MongoDB has released patches and recommends users immediately update to versions 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32, or 4.4.30.
Critical Vulnerability in n8n
In December 2025, a serious security flaw was discovered in the popular n8n tool. The vulnerability, tracked as CVE-2025–68613, received a critical CVSS rating of 9.9 out of a maximum 10 points. This flaw allows authenticated attackers to remotely execute arbitrary code on affected servers, which can lead to complete system compromise.
The vulnerability was discovered by security researcher Fatih Çelik and lies in insufficient isolation in the workflow evaluation system. An attacker with access to the system can exploit this flaw to execute arbitrary code with n8n process privileges, opening the door to unauthorized access to sensitive data, modification of workflows, and performing operations at the operating system level.
The most affected systems are located in the United States with nearly 28,500 instances, followed by Germany with 17,500 and France with more than 10,000 instances. A significant number of vulnerable servers were also identified in Brazil, Singapore, and India. The n8n package on npm registers approximately 57,000 downloads per week, demonstrating the widespread adoption of this tool.
The vulnerability affects all versions of n8n starting from version 0.211.0 up to version 1.120.4. Developers responded by releasing patched versions 1.120.4, 1.121.1, and 1.122.0, which introduce additional security measures.