ZhongStealer is an information-stealing trojan that targets credentials, session tokens, cryptocurrency wallets, and browser-stored data. First documented in late 2023, this malware emerged from Chinese-language cybercrime forums and quickly spread through software cracks, fake game cheats, and pirated productivity tools. Unlike ransomware that announces itself, ZhongStealer operates silently in the background, exfiltrating sensitive data to remote command-and-control servers while leaving minimal traces of its presence.
The stealer is particularly dangerous because it harvests data from dozens of applications simultaneously — including Discord, Telegram, Steam, multiple cryptocurrency wallets, and all major web browsers. By the time most victims realize they've been compromised, their passwords, authentication cookies, and financial information have already been transmitted to attackers. The malware's modular design allows operators to customize which data to target, making each infection potentially unique in scope.
ZhongStealer infections frequently arrive bundled with other malware, including clipper trojans that hijack cryptocurrency transactions and remote access tools that enable persistent control. This multi-stage infection pattern means removing the visible stealer doesn't guarantee a clean system — the initial dropper may have installed additional payloads that remain active even after the primary executable is deleted.
Threat Profile
| Attribute | Details |
|---|---|
| Malware Family | Information Stealer / Credential Harvester |
| Primary Aliases | Zhong Stealer, ZhongInfoStealer, Zhong RAT (misnomer — not primarily a remote access tool) |
| Target Platform | Windows 7 through Windows 11 (x86 and x64 architectures) |
| First Documented | Late 2023 (specific month varies by security vendor) |
| Distribution Methods | Cracked software, fake game cheats, torrent bundles, malvertising, phishing attachments |
| Persistence Mechanisms | Registry Run keys, Startup folder shortcuts, scheduled tasks (varies by variant) |
| Primary Capabilities | Browser credential extraction, cookie/session token theft, cryptocurrency wallet targeting, Discord/Telegram token harvesting, screenshot capture, file enumeration, system fingerprinting |
| Targeted Applications | Chrome, Edge, Firefox, Brave, Opera, Opera GX, Exodus wallet, Atomic wallet, Electrum, MetaMask, Discord, Telegram, Steam, Epic Games Launcher, FileZilla (FTP credentials), and others |
| Network Behavior | HTTPS POST requests to hardcoded or dynamically resolved C2 servers; encrypted data exfiltration; sometimes uses Telegram Bot API as backup exfiltration channel |
| Typical Artifacts | Randomly-named executables in %APPDATA% or %LOCALAPPDATA% subdirectories; temporary .zip or .txt files with harvested data prior to transmission; sometimes drops .bat cleanup scripts |
| Payload Size | 100KB–600KB for core stealer binary (varies with included modules and packer) |
| Removal Difficulty | Moderate — persistence is straightforward, but identifying all dropped components and assessing data compromise requires expertise |
How It Spreads
ZhongStealer relies primarily on social engineering and the appeal of "free" software to gain initial access. The most common infection vector is cracked commercial software downloaded from file-sharing sites, torrent trackers, or sketchy download portals. Users searching for "Adobe Photoshop crack" or "Microsoft Office activator" find what appears to be legitimate software but actually receive a bundled installer that drops ZhongStealer alongside (or instead of) the promised application. The crack may even appear to work initially, masking the infection while the stealer operates in the background.
Gaming communities represent another major attack surface. Threat actors package ZhongStealer inside fake game cheats, aim assistants, and "free V-Bucks" generators targeting popular titles like Fortnite, Valorant, and Call of Duty. Young gamers and casual users who bypass security warnings to install these tools rarely realize they've compromised their entire digital identity for a competitive advantage that never materializes. The gaming angle is particularly effective because these communities normalize downloading unofficial tools and frequently disable antivirus software at the instruction of cheat developers.
Beyond software piracy and gaming cheats, ZhongStealer spreads through:
- Malvertising campaigns — Fake download buttons on legitimate-looking software review sites that deliver the stealer instead of the advertised application
- YouTube video descriptions — Links in tutorial videos promising free software, game mods, or cryptocurrency generators that lead to ZhongStealer droppers
- Email attachments — Invoice-themed phishing emails with password-protected ZIP files containing the stealer (password provided in email body to bypass gateway scanners)
- Discord and Telegram shares — Direct messages or channel posts from compromised accounts sharing "exclusive tools" that are actually malware installers
- Bundled with other malware — Delivered as a secondary payload by existing infections like Smoke Loader or other malware-as-a-service platforms
- Fake software update prompts — Browser pop-ups claiming your media player, PDF reader, or security software is outdated, with a download link leading to the stealer
What It Does On Your Machine
Once executed, ZhongStealer immediately begins its reconnaissance phase, fingerprinting the infected system to identify valuable data sources. The malware scans for installed applications by checking registry keys, searching common installation directories, and enumerating browser profile folders. This initial scan typically completes in seconds and generates a target list of applications containing credentials, authentication tokens, or financial information worth exfiltrating.
Browser data extraction represents the stealer's primary function. ZhongStealer targets the local database files where browsers store saved passwords, cookies, autofill data, and browsing history. For Chromium-based browsers (Chrome, Edge, Brave, Opera), the malware accesses the encrypted "Login Data" SQLite database and uses the Windows Data Protection API (DPAPI) to decrypt stored credentials — the same legitimate mechanism the browser uses. Firefox profiles are targeted through their "logins.json" and key database files. The stealer extracts not just passwords but also authentication cookies that allow attackers to bypass two-factor authentication by hijacking active sessions.
Cryptocurrency wallet targeting is particularly aggressive. ZhongStealer searches for wallet applications' local storage directories where seed phrases, private keys, and wallet configuration files are stored. Even if a wallet is password-protected, the malware exfiltrates the encrypted wallet file itself, which attackers can then attempt to crack offline using specialized tools. Browser extension wallets like MetaMask are especially vulnerable because their data is stored alongside other browser information and often protected with weaker encryption than standalone wallet applications.
After harvesting data, ZhongStealer compiles everything into an archive (usually a ZIP file with a random name) stored temporarily in the %TEMP% or %APPDATA% directory. The malware then transmits this archive to its command-and-control infrastructure via HTTPS POST requests, sometimes disguised as legitimate-looking traffic to cloud storage services or using Telegram's Bot API as an exfiltration channel. Once transmission is confirmed, most variants delete the temporary archive and either remove themselves entirely or remain dormant to avoid detection — though some versions persist for ongoing monitoring.
Manual Removal — Step by Step
Disconnect from Network Immediately
Unplug your ethernet cable or disable WiFi before proceeding. ZhongStealer may still be transmitting data or receiving commands from its control server. Working offline prevents additional credential theft and stops the malware from downloading secondary payloads. Do not reconnect until removal is complete and verified.
Boot into Safe Mode with Networking
Restart your computer and press F8 repeatedly during boot (or Shift+Restart from Windows, then navigate to Troubleshoot > Advanced Options > Startup Settings > Restart > option 5). Safe Mode loads only essential drivers and services, preventing ZhongStealer from loading its persistence mechanisms and making removal easier. "With Networking" allows you to download tools if needed, though stay offline initially.
Identify and Terminate Suspicious Processes
Press Ctrl+Shift+Esc to open Task Manager. Look for unfamiliar processes, especially those with names like "svchost.exe" running from user directories (%APPDATA% or %LOCALAPPDATA% — the legitimate svchost.exe only runs from C:\Windows\System32). Note the exact file location, right-click the process, select "Open file location," then end the task. Do not delete files yet — just terminate active processes.
Remove Persistence Mechanisms
Open Registry Editor (Win+R, type "regedit") and navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. Look for unfamiliar entries pointing to executables in %APPDATA% or %LOCALAPPDATA% directories. Delete suspicious entries, noting their file paths. Then check your Startup folder (type "shell:startup" in the Run dialog) and remove any suspicious shortcuts. Open Task Scheduler (taskschd.msc) and review scheduled tasks for recently created entries with random names or suspicious trigger conditions.
Delete Malware Files and Directories
Navigate to the file locations you identified earlier using File Explorer. Delete the entire parent directory containing the malware executable (typically a randomly-named folder under %LOCALAPPDATA% or %APPDATA%). Empty your Recycle Bin immediately. Also check %TEMP% for recent ZIP files or data collection artifacts and delete those as well. If you receive "file in use" errors, you didn't successfully terminate the process — return to Task Manager.
Run Malwarebytes Full System Scan
Download Malwarebytes (free version is sufficient) from a known-clean computer, transfer via USB if needed, or carefully reconnect to download directly. Install and run a complete system scan, not just a quick scan. Malwarebytes maintains updated signatures for ZhongStealer variants and will catch remnants or additional payloads you may have missed. Quarantine or delete all detected items, then restart the computer normally (still offline).
Reset All Browser Profiles
Since ZhongStealer compromises browser data, reset each installed browser to defaults. In Chrome/Edge, go to Settings > Reset and clean up > Restore settings to their original defaults. In Firefox, type "about:support" in the address bar and click "Refresh Firefox." This removes malicious extensions and clears potentially compromised data. You'll need to re-enter saved passwords (which you'll be changing anyway).
Change All Passwords from a Clean Device
Do NOT change passwords on the infected machine — use a smartphone, tablet, or another verified-clean computer. Assume every credential stored in your browsers has been compromised. Start with email accounts (which control password resets for everything else), then financial institutions, cryptocurrency exchanges, social media, gaming platforms, and shopping sites. Enable two-factor authentication everywhere possible during this process.
Secure Cryptocurrency Wallets Immediately
If you use cryptocurrency wallets, assume your seed phrases and private keys are compromised. Transfer all funds to new wallets with newly-generated seed phrases as quickly as possible — time is critical here. Create the new wallets on a confirmed-clean device, not the infected machine. Even if you "successfully" removed ZhongStealer, attackers may have already exfiltrated your wallet data and could drain accounts at any moment.
Reboot, Reconnect, and Monitor
Restart your computer one final time in normal mode. Reconnect to the internet and immediately check for Windows updates and security patches. Monitor your bank accounts, credit cards, and email for suspicious activity over the next several weeks. Consider placing a fraud alert with credit bureaus if you stored sensitive financial documents on the infected machine. Run periodic scans with Malwarebytes weekly for at least a month to catch any delayed-activation payloads.
Prevention
- Never download cracked software or key generators. These are the primary distribution mechanism for information stealers like ZhongStealer. If you can't afford software, look for legitimate free alternatives (GIMP instead of Photoshop, LibreOffice instead of Microsoft Office) rather than risking your entire digital identity for a pirated copy.
- Avoid game cheats and aim assistants from unofficial sources. Besides violating terms of service and risking account bans, these tools are overwhelmingly trojanized with credential stealers. The competitive advantage isn't worth the security compromise, and most "working" cheats are actually malware with no functionality beyond stealing your data.
- Use a password manager instead of browser-saved passwords. Dedicated password managers like Bitwarden, 1Password, or KeePass use stronger encryption than browsers and aren't typically targeted by information stealers designed for mass credential harvesting. They also make it easier to use unique passwords for every account, limiting damage if one site is breached.
- Enable two-factor authentication everywhere possible. While session token theft can bypass 2FA temporarily, it significantly raises the bar for attackers and prevents simple password reuse attacks. Use authenticator apps (Google Authenticator, Authy) rather than SMS when available — text-message 2FA is better than nothing but vulnerable to SIM-swapping attacks.
- Store cryptocurrency wallet seed phrases offline only. Never save seed phrases in text files, screenshots, cloud storage, or password managers connected to the internet. Write them on paper and store in a secure physical location. Hardware wallets (Ledger, Trezor) provide additional protection by keeping private keys isolated from the computer entirely.
- Keep security software active and updated. Modern Windows Defender is reasonably effective against known stealer variants if kept updated and not disabled. Supplement with periodic Malwarebytes scans. Never disable your antivirus at the instruction of a game cheat, crack, or "optimization tool" — that's a massive red flag that you're about to install malware.
- Scrutinize download sources carefully. Even legitimate-looking software review sites can contain malvertising with fake download buttons. When downloading anything, ensure you're on the official developer website (check the URL carefully — attackers register similar domains). For popular free software, prefer established repositories like Ninite or Chocolatey.
- Review installed applications and browser extensions regularly. Open your Windows Apps & Features list monthly and remove anything you don't recognize or no longer use. Check browser extensions similarly — information stealers sometimes install malicious extensions as part of their infection routine, and these can persist even after the main malware is removed.
Bring It In
ZhongStealer removal isn't just about deleting files — it's about assessing exactly what data was compromised, ensuring no secondary payloads remain active, and securing your accounts before attackers exploit stolen credentials. The manual steps above work for technically-inclined users who catch infections early, but if you're uncertain about any step or if the infection has been active for more than a few days, professional verification is worth the investment. Cryptocurrency theft and identity fraud cause far more financial damage than a professional malware removal service costs.
Computer Repair Roswell has handled hundreds of information stealer infections for Roswell residents and businesses. We'll thoroughly clean your system, verify complete removal, help you assess which accounts need immediate attention, and explain exactly what happened so you can avoid reinfection. Call us at (770) 667-9975 or visit our shop at 1614 Hembree Road, Roswell, GA 30076 during business hours. If you're dealing with an active infection right now, call immediately — we understand that credential theft requires urgent response, and we'll prioritize getting you secured.