DeerStealer is a Windows information stealer first documented by ANY.RUN in 2024, assessed as a reworked variant of the XFiles stealer and sold as malware-as-a-service. It was initially spread through fake Google Authenticator pages advertised on Google, and later through ClickFix fake-verification pages that load it via HijackLoader. It steals browser data and crypto wallets, hijacks clipboard wallet addresses, and includes hidden VNC remote access.

DeerStealer: From Fake Google Authenticator to ClickFix

DeerStealer is a Windows information stealer first documented by ANY.RUN in 2024, initially spread through fake Google Authenticator download pages promoted via Google ads. Widely assessed as a reworked variant of the XFiles infostealer and sold as MaaS by a forum actor using the handle “LuciferXfiles,” its delivery shifted through 2025 to ClickFix fake-verification chains that trick users into pasting a PowerShell command into the Run dialog, pulling in HijackLoader, which then loads DeerStealer.

Overview

ANY.RUN named DeerStealer during the 2024 fake Google Authenticator campaign and noted technical differences from classic XFiles (DeerStealer compiles to native code; XFiles is .NET), so “reworked variant” is the defensible framing. Reported subscription tiers (single-source, treat as reported) range from a premium tier around $200 per month to a professional tier around $3,000 per month.

Delivery

Fake Google Authenticator (2024): Google ads led to lookalike Google pages; the download button beaconed the visitor’s IP and country to a Telegram bot, then served a GitHub-hosted installer that side-loaded a malicious DLL. T1204.001 T1574.002
ClickFix + HijackLoader (2025): fake-verification pages instruct the victim to run a PowerShell command in the Run box, loading HijackLoader and then DeerStealer. T1204.004 T1059.001

Technical Capabilities

Browser data from a large set of browsers and credentials, cookies and autofill. T1555.003 T1539
Multiple cryptocurrency wallet types, with clipboard monitoring to replace copied wallet addresses. T1115
Hidden VNC for stealthy remote access, host fingerprinting, and persistence via scheduled tasks with the ability to switch C2 servers. T1053.005

MITRE ATT&CK Mapping

Note

Analyst-mapped; DeerStealer has no official ATT&CK Software entry.

Tactic	Technique	Usage
Execution	T1204.004 Malicious Copy and Paste	ClickFix delivery
Defense Evasion	T1574.002 DLL Side-Loading	Fake Authenticator installer
Collection	T1115 Clipboard Data	Wallet-address hijacking
Credential Access	T1555.003 Web Browsers	Saved logins
Persistence	T1053.005 Scheduled Task	Persistence, C2 switching

Detection & Mitigation

Scrutinise Google ads leading to lookalike Google or Authenticator domains serving installers that side-load DLLs.
Train users never to paste commands into the Run dialog; where feasible restrict Run-dialog script execution.
EDR rules for DLL side-loading, HijackLoader and hidden-VNC sessions; monitor api.telegram.org egress and clipboard integrity.

Contain Infostealer Compromise

Mjolnir Security helps organisations detect malvertising- and ClickFix-delivered stealers.

Threat HuntingManaged Detection & ResponseSecurity AwarenessIncident ResponseCredential Exposure Monitoring

Threat Hunting as a Service Hunting for DLL side-loading, HijackLoader and hidden-VNC behaviours.
Security Awareness Targeted training against malvertising and ClickFix paste-and-run lures.
24/7 Incident Response Containment and credential rotation when stealer activity is detected. Call +1 833 403 5875.

Written by: Mjolnir Security  |  Published: October 11, 2026

Overview

Delivery

Technical Capabilities

MITRE ATT&CK Mapping

Detection & Mitigation

Contain Infostealer Compromise

ClickFix: The Fake-CAPTCHA Technique That Makes Victims Infect Themselves

RedLine Stealer: The Infostealer That Fueled a Cybercrime Empire