Silent Watcher Malware Steals Windows Data Using VBS Scripts

K7 Security Labs researchers have raised the alarm after discovering an infostealer malware affecting Windows devices, dubbed “Silent Watcher.” Part of the Cmimai malware family, Silent Watcher demonstrates sophisticated mechanisms to achieve long-term persistence and redundant data exfiltration.

Researchers identified the malware due to its distinctive code signature and webhook-based communication patterns. Its multi-stage attack begins with deploying multiple PowerShell scripts to capture different types of information, such as “vbs_ps_browser.ps1” for browser metadata and “vbs_ps_diag.ps1” for screenshots.

Combined with the ability to bypass PowerShell’s built-in execution policies and with a minimal footprint, it’s designed to be hard to detect. What makes it even more evasive is that Silent Watcher uses timed 1-hour sleep cycles in between active data collection windows.

Collected data is stored in temporary files with randomized names under Windows’ default Temp folder. For example, “vbs_reporter_log.txt,” holds the computer system and browser data. These temporary files are deleted on a regular basis to minimize forensic traces.

Via these methods, Silent Watcher also extracts system specifications, user credentials, and more. This data is then packaged into JSON payloads to be transmitted by hijacking Discord webhooks. To ensure that data exfiltration is successful, it also uses WinHttp.WinHttpRequest.5.1 and MSXML2.ServerXMLHTTP objects for added redundancy.

While we don’t yet know how the malware propagates, it doesn’t seem to exhibit any self-spreading capabilities. However, Cmimai stealers are typically distributed via phishing emails or malicious attachments/zipped/installer files. Any Windows system is potentially vulnerable, and target computers do not have to have Discord installed for the virus to exfiltrate stolen data.

Malware developers are constantly looking for ways to achieve greater long-term persistence and evade detection methods. A popular infostealer, StealC, received a major update earlier this year with enhanced stealth capabilities. Infections can also come from virtually anywhere; a video game hosted on Steam was recently discovered to contain password-stealing malware.