Lucid Stealer Hits 18 Browsers, Crypto Wallets, and Discord Tokens

Gbhackers •Mayura Kathir • June 8, 2026

A new, fully featured Lucid Stealer build that combines large-scale credential theft with hidden remote access. The sample, distributed through Telegram-linked underground channels, is not a simple packed executable but a Lucid-branded information stealer and RAT wrapped inside a legitimate Node.js Single Executable Application (SEA). Static analysis recovered an embedded JavaScript loader and decrypted core […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Lucid Stealer Malware Targets 18 Browsers and Crypto Wallets A new variant of the Lucid Stealer malware has been identified, capable of targeting 18 different browsers, cryptocurrency wallets, and Discord tokens. This malware, which functions as both an information stealer and a remote access Trojan (RAT), is distributed through Telegram-linked underground channels. Unlike typical malware, it is packaged as a legitimate Node.js Single Executable Application (SEA), making detection challenging. Cybersecurity experts warn that it can gain full control over infected machines, significantly increasing the risk of data theft. The malware's capabilities extend beyond simple credential theft, indicating a sophisticated threat landscape. Current reports suggest that the malware is actively being disseminated, raising alarms among security professionals. Organizations using affected browsers and wallets are advised to enhance their security measures. 2 sources 66

Extracted Entities

Lucid Stealer Hits 18 Browsers, Crypto Wallets, and Discord Tokens

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (2)

Tools (1)