BluelineStealer Malware — Analysis, Campaigns & Threat Activity

Threat entity extracted from intelligence sources

Frequency
2
occurrences
First Seen
December 15, 2025
Last Seen
December 16, 2025

Note: The provided articles refer to SantaStealer, not BluelineStealer.

Overview

Note: The provided articles refer to SantaStealer, not BluelineStealer. SantaStealer is described as a malware-as-a-service data stealer that targets browsers and cryptocurrency wallets to exfiltrate credentials and wallet data. Its MaaS model lowers barriers to entry for cybercriminals and accelerates the distribution of data-stealing capabilities, making it a notable development in the threat landscape.

Related Threat Clusters

  • SantaStealer Malware-as-a-Service Launching This Holiday Season

    A new malware-as-a-service called SantaStealer, previously known as BluelineStealer, is set to launch before the end of 2025. Advertised on Telegram and hacker forums, SantaStealer is designed to collect sensitive…

    4 articles · Updated December 16, 2025

Recent Intelligence Reports

  • Rapid7 unwraps new SantaStealer malware-as-a-service — Scmagazine · December 16, 2025
  • New SantaStealer malware steals data from browsers, crypto wallets — Bleepingcomputer · December 15, 2025

CVSS v3.1 Breakdown