Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

SantaStealer

Also known as:Santa StealerBluelineStealer

What is the SantaStealer infostealer, and what data does it steal?

SantaStealer (also known as Santa Stealer and BluelineStealer) is an information-stealing malware family operating under the MaaS model. SantaStealer targets browser credentials, cryptocurrency wallets, Steam/Telegram/Discord session tokens, Saved credit card data from browsers, Documents matching the file-grabber filter list and Desktop screenshots. As of 23/10/2026, CyStack's research records 1 variant distributed through 1 channel, with high attribution confidence.

Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes

Description

Original English

SantaStealer is a malware-as-a-service info-stealer first publicly documented in December 2025. The operation is a rebrand of an earlier project named BluelineStealer; the SantaStealer brand is the operator-side relaunch ahead of an end-of-year launch push. The researchers obtained samples and access to the affiliate web panel, and identified a Russian-speaking developer. Pricing is Basic at $175 per month and Premium at $300 per month, advertised on Telegram and hacker forums.

The malware runs 14 data-collection modules in parallel threads (browser passwords, cookies, history, credit cards, Telegram / Discord / Steam sessions, crypto wallet apps and browser extensions, document grabber, desktop screenshots). Collected data is written to memory, archived into a Log.zip file in %TEMP%, split into 10 MB chunks, and exfiltrated over unencrypted HTTP to a hardcoded C2 IP on port 6767. The malware self-advertises through the Telegram channel t.me/SantaStealer, which is also embedded verbatim in every artifact the malware writes.

Operator panels & distribution channels

1 distinct distribution channel recorded for this malware

Data provided by

Accelerate investigation with professional monitoring solutions

Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.

Explore Threat Intelligence

Variants (1)

1 variant recorded for this malware

ID	Data collected	Confidence
`e8de83d...`	2	High

Data limited to 5 variants

To see more variants, organizations should use dedicated solutions such as CyStack Threat Intelligence

Explore CyStack Threat Intelligence