Skuld: The Emerging Golang-based Info Stealer Targeting Global Windows Users

A new information stealer called Skuld has been discovered, and it is currently targeting Windows systems worldwide. It has been observed compromising systems across Europe, Southeast Asia, and the United States. The malware is designed to steal sensitive information from its victims, including data stored in applications such as Discord and web browsers, as well as information from the system and files stored in the victim’s folders.

Skuld’s information-stealing capabilities

The Skuld malware is the creation of a developer who goes by the online alias “Deathined” on social media platforms. What makes the Skuld malware unique is its ability to steal sensitive information from a wide range of sources, including different types of data in web browsers and applications such as Discord.

Skuld is designed to steal sensitive information from its victims. This includes data stored in web browsers, applications, system files, and documents. Skuld can extract cookies and credentials stored in web browsers and files present in the Windows user profile folders, as well as information stored in the system and in different applications such as Discord.

The Developer behind Skuld

The Skuld malware is developed by a person who goes by the name Deathined. The developer is suspected to be based in Southeast Asia and is known for creating different types of malware that are used for information stealing, including infostealers, keyloggers, and remote access tools.

Methods to steal information

The Skuld malware uses different methods to steal sensitive information from the victim’s computer. Besides gathering system metadata, the malware possesses capabilities to harvest cookies and credentials stored in web browsers, as well as files present in the Windows user profile folders.

Skuld’s Detection and Termination Mechanisms

Skuld is designed to detect and terminate any process that matches those present on the blocklist. The malware checks whether it is running in a virtual environment and extracts the list of running processes, terminating any process that matches those on the blocklist.

Detection of Virtual Environments

Skuld is designed to check if it’s running in a virtual environment. If it detects that it’s running in a virtual environment, it extracts the list of running processes, terminates any process that matches those present in the blocklist, and attempts to evade analysis.

Terminating blocked processes

Skuld is designed to terminate any blocked processes. The malware checks if there are any processes that match those present in the blocklist, and if so, it terminates them.

The Skuld malware is designed to hijack Discord accounts to gain access to sensitive information. The malware corrupts legitimate files associated with Better Discord and Discord Token Protector, and injects JavaScript code into the Discord app to siphon backup codes – mirroring a technique similar to that of another Rust-based info-stealer.

Corrupting Legitimate Files

Skuld is designed to corrupt legitimate files associated with Better Discord and Discord Token Protector. This allows the malware to inject JavaScript code into the Discord app to steal backup codes.

The potential for a Skuld clipper module

The cybersecurity company that discovered Skuld believes that it is likely in development to incorporate a clipper module to alter clipboard content and steal cryptocurrency assets by swapping wallet addresses. This is a new tactic that is becoming increasingly popular with malware developers.

Skuld’s Data Exfiltration Methods

Skuld is designed to exfiltrate data from the victim’s computer. The malware does so by using an actor-controlled Discord webhook or the Gofile upload service.

Discord Webhook

The Skuld malware uses an actor-controlled Discord webhook to exfiltrate data from the victim’s computer. A webhook is a way for a third-party application to communicate with a service like Discord.

Gofile is an upload service

Skuld is designed to use the Gofile upload service to exfiltrate data from the victim’s computer. This service allows the malware to upload files from the victim’s computer to a remote server controlled by the attacker.

The Rise of Go in Malware Development

Golang’s steady adoption among threat actors, due to its simplicity, efficiency and cross-platform compatibility, makes it an attractive vehicle to target multiple operating systems and expand their victim pool.

The Attractiveness of Golang for Malware Development

Golang is considered attractive for malware development activities due to its efficiency, simplicity, and cross-platform compatibility. These features make it easier for malware developers to create binary executables that run on multiple platforms.

Difficulty in Detecting and Mitigating Golang-Based Malware

The compiled nature of Golang makes it difficult for security researchers and traditional anti-malware solutions to effectively detect and mitigate these threats.

The Skuld malware is a new information stealer that has been designed to steal sensitive data from victims’ computers. It uses a variety of techniques to do so, including Discord hijacking, detecting virtual environments, and blocking processes. Skuld’s developers appear to be based in Southeast Asia, and the malware is part of a larger trend of malware written in Golang becoming increasingly common. If malware authors continue to utilize Golang, security professionals must adapt and find new ways to detect and mitigate these threats effectively.

Explore more

UK’s 5G Networks Lag Behind Europe in Quality and Coverage

In 2025, a digital challenge hovers over the UK as the nation grapples with underwhelming 5G network performance compared to its European counterparts. Recent analyses from MedUX, a firm specializing in mobile network assessment, have uncovered significant discrepancies between the UK’s target for 5G accessibility and real-world consumer experiences. While theoretical models predict widespread reach, everyday exchanges suggest a different

Shared 5G Standalone Spectrum – Review

The advent of 5G technology has revolutionized telecommunications by ushering in a new era of connectivity. Among these innovations, shared 5G Standalone (SA) spectrum emerges as a novel approach to address increasing data demands. With mobile data usage anticipated to rise to 54 GB per month by 2030, mainly due to indoor consumption, shared 5G SA spectrum represents a significant

How Does Magnati-RAKBANK Partnership Empower UAE SMEs?

The landscape for small and medium-sized enterprises (SMEs) in the UAE is witnessing a paradigm shift. Facing obstacles in accessing finance, SMEs now have a lifeline through the strategic alliance between Magnati and RAKBANK. This collaboration emerges as a pivotal force in transforming financial accessibility, employing advanced embedded finance services tailored to SMEs’ unique needs. It’s a partnership set to

How Does Azure Revolutionize Digital Transformation?

In today’s fast-paced digital era, businesses must swiftly adapt to remain competitive in the ever-evolving technological landscape. The concept of digital transformation has become essential for organizations seeking to integrate advanced technologies into their operations. One key player facilitating this transformation is Microsoft Azure, a cloud platform that’s enabling businesses across various sectors to modernize, scale, and innovate effectively. Through

Digital Transformation Boosts Efficiency in Water Utilities

In a world where water is increasingly scarce, the urgency for efficient water management has never been greater. The global water utilities sector, responsible for supplying this vital resource, is facing significant challenges. As demand is projected to surpass supply by 40% within the next decade, water utilities worldwide struggle with inefficiencies and high water loss, averaging losses of one-third