DebugElevator Stealer

What kind of malware is DebugElevator Stealer?

DebugElevator is a credential-stealing malware distributed via a supply chain attack on popular Laravel PHP developer packages. According to research by StepSecurity, Aikido Security, and Socket, attackers compromised four Laravel Lang repositories and injected a dropper that silently downloads and runs the stealer on developer machines.

The stealer's Windows component is named DebugElevator. Once on a system, it harvests browser passwords, cloud credentials, SSH keys, cryptocurrency wallet files, and various developer secrets, then sends everything to an attacker-controlled server.

DebugElevator Stealer malware detections on VirusTotal

DebugElevator Stealer overview

The attack targeted PHP developers who rely on a package manager called Composer. Attackers rewrote GitHub tags in four Laravel Lang repositories to point to malicious forks, affecting roughly 700 historical package versions.

A malicious PHP file, src/helpers.php, was secretly added to the affected packages. Whenever a developer installed or updated one of those packages, this file ran automatically and downloaded the stealer payload from the attacker's C2 server at flipboxstudio[.]info.

The dropper delivers platform-specific payloads. On Windows, the downloaded component is the DebugElevator executable. It focuses on extracting App-Bound Encryption keys from Chrome, Brave, and Edge - the mechanism those browsers use to protect stored passwords - and using them to decrypt all saved login credentials.

Targeted data

DebugElevator collects a broad range of sensitive material. Using regex pattern matching, it scans for cloud credentials, Kubernetes configuration files, Vault tokens, AWS keys, GitHub tokens, Slack tokens, and Stripe secrets.

It also targets CI/CD pipeline secrets, Git credentials, SSH private keys, cryptocurrency wallet files, VPN configuration files, and password manager data. Developer .env files, which often hold database passwords and API keys in plain text, are targeted as well.

All collected data is encrypted before being sent to the attacker's server, making the theft difficult to detect in transit.

Threat Summary:
Name	DebugElevator info stealer
Threat Type	Information Stealer, Trojan, Password-stealing virus
Detection Names	Alibaba (RiskWare:Win64/Elevator.a0e7584c), Kaspersky (Not-a-virus:PSWTool.Win64.Elevator.a), Sophos (Generic Reputation PUA (PUA)), Symantec (ML.Attribute.HighConfidence), Full List (VirusTotal)
Symptoms	Stealers are designed to stealthily infiltrate the victim's computer and remain silent, and thus no particular symptoms are clearly visible on an infected machine.
Distribution methods	Supply chain attack, compromised PHP Composer packages, malicious software dependencies.
Damage	Stolen passwords and banking information, identity theft, stolen cloud credentials, account hijacking, monetary loss, stolen SSH keys and API tokens.
Malware Removal (Windows)	To eliminate possible malware infections, scan your computer with legitimate antivirus software. Our security researchers recommend using Combo Cleaner. Download Combo Cleaner To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by RCS LT, the parent company of PCRisk.com.

Conclusion

DebugElevator Stealer is a serious threat to developers who use Laravel Lang packages. By abusing a trusted dependency channel, attackers can silently steal browser passwords, cloud credentials, SSH keys, and API tokens without any visible signs of infection.

Victims can face account takeover, unauthorized access to cloud infrastructure, loss of cryptocurrency, and exposure of sensitive project secrets. The malware should be removed from the system immediately.

More examples of stealers are Evolution, LofyStealer, and Needle.

How did DebugElevator Stealer infiltrate my computer?

According to researchers at StepSecurity, Aikido Security, and Socket, DebugElevator Stealer reached victims through a supply chain attack. Attackers hijacked four Laravel Lang packages on GitHub, inserting hidden code that silently downloaded the stealer when developers installed the compromised versions.

The malicious code ran automatically as part of the package installation process. It contacted an external server, fetched the DebugElevator executable, and ran it on the developer's Windows machine. Packagist - the PHP package repository - removed the affected versions after researchers reported the campaign.

Beyond supply chain attacks, threats of this kind also spread through phishing emails, fake software download sites, pirated programs, and malicious email attachments. Verifying the integrity of software dependencies and using security tools can help reduce the risk of infection.

How to avoid installation of malware?

Keep your operating system and all installed applications up to date. Download software only from official sources and avoid cracked or unofficial versions of programs. Be cautious with unexpected emails and avoid clicking suspicious links or advertisements from untrustworthy sources.

If you believe that your computer is already infected, we recommend running a scan with Combo Cleaner Antivirus for Windows to automatically eliminate infiltrated malware.

Instant automatic malware removal:

Manual threat removal might be a lengthy and complicated process that requires advanced IT skills. Combo Cleaner is a professional automatic malware removal tool that is recommended to get rid of malware. Download it by clicking the button below:

DOWNLOAD Combo Cleaner

By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by RCS LT, the parent company of PCRisk.com.

Quick menu:

What is DebugElevator Stealer?
STEP 1. Manual removal of DebugElevator Stealer malware.
STEP 2. Check if your computer is clean.

How to remove malware manually?

Manual malware removal is a complicated task - usually it is best to allow antivirus or anti-malware programs to do this automatically. To remove this malware we recommend using Combo Cleaner Antivirus for Windows.

If you wish to remove malware manually, the first step is to identify the name of the malware that you are trying to remove. Here is an example of a suspicious program running on a user's computer:

Malware process running in the Task Manager

If you checked the list of programs running on your computer, for example, using task manager, and identified a program that looks suspicious, you should continue with these steps:

manual malware removal step 1 Download a program called Autoruns. This program shows auto-start applications, Registry, and file system locations:

Autoruns application appearance

manual malware removal step 2 Restart your computer into Safe Mode:

Windows XP and Windows 7 users: Start your computer in Safe Mode. Click Start, click Shut Down, click Restart, click OK. During your computer start process, press the F8 key on your keyboard multiple times until you see the Windows Advanced Option menu, and then select Safe Mode with Networking from the list.

Run Windows 7 or Windows XP in Safe Mode with Networking

Video showing how to start Windows 7 in "Safe Mode with Networking":

Windows 8 users: Start Windows 8 is Safe Mode with Networking - Go to Windows 8 Start Screen, type Advanced, in the search results select Settings. Click Advanced startup options, in the opened "General PC Settings" window, select Advanced startup.

Click the "Restart now" button. Your computer will now restart into the "Advanced Startup options menu". Click the "Troubleshoot" button, and then click the "Advanced options" button. In the advanced option screen, click "Startup settings".

Click the "Restart" button. Your PC will restart into the Startup Settings screen. Press F5 to boot in Safe Mode with Networking.

Run Windows 8 in Safe Mode with Networking

Video showing how to start Windows 8 in "Safe Mode with Networking":

Windows 10 users: Click the Windows logo and select the Power icon. In the opened menu click "Restart" while holding "Shift" button on your keyboard. In the "choose an option" window click on the "Troubleshoot", next select "Advanced options".

In the advanced options menu select "Startup Settings" and click on the "Restart" button. In the following window you should click the "F5" button on your keyboard. This will restart your operating system in safe mode with networking.

Run Windows 10 in Safe Mode with Networking

Video showing how to start Windows 10 in "Safe Mode with Networking":

manual malware removal step 3 Extract the downloaded archive and run the Autoruns.exe file.

Extract Autoruns.zip archive and run Autoruns.exe application

manual malware removal step 4 In the Autoruns application, click "Options" at the top and uncheck "Hide Empty Locations" and "Hide Windows Entries" options. After this procedure, click the "Refresh" icon.

Refresh Autoruns application results

manual malware removal step 5 Check the list provided by the Autoruns application and locate the malware file that you want to eliminate.

You should write down its full path and name. Note that some malware hides process names under legitimate Windows process names. At this stage, it is very important to avoid removing system files. After you locate the suspicious program you wish to remove, right click your mouse over its name and choose "Delete".

Delete malware in Autoruns

After removing the malware through the Autoruns application (this ensures that the malware will not run automatically on the next system startup), you should search for the malware name on your computer. Be sure to enable hidden files and folders before proceeding. If you find the filename of the malware, be sure to remove it.

Search for malware and delete it

Reboot your computer in normal mode. Following these steps should remove any malware from your computer. Note that manual threat removal requires advanced computer skills. If you do not have these skills, leave malware removal to antivirus and anti-malware programs.

These steps might not work with advanced malware infections. As always it is best to prevent infection than try to remove malware later. To keep your computer safe, install the latest operating system updates and use antivirus software. To be sure your computer is free of malware infections, we recommend scanning it with Combo Cleaner Antivirus for Windows.

Frequently Asked Questions (FAQ)

My computer is infected with DebugElevator Stealer malware, should I format my storage device to get rid of it?

Formatting the storage device will remove DebugElevator Stealer, but it will also erase every file on the drive. A reputable security tool such as Combo Cleaner should normally be tried first, as it can remove the infection without wiping your data.

What are the biggest issues that DebugElevator Stealer malware can cause?

DebugElevator Stealer can steal browser passwords, cloud service credentials, SSH keys, cryptocurrency wallets, and API tokens. Victims may face account takeover, unauthorized access to cloud infrastructure, financial loss, and exposure of sensitive developer secrets.

What is the purpose of DebugElevator Stealer malware?

The purpose of DebugElevator Stealer is to harvest sensitive data from infected devices - including browser credentials, cloud tokens, SSH keys, and cryptocurrency wallet files - and send them to the attacker's server.

How did DebugElevator Stealer malware infiltrate my computer?

DebugElevator Stealer was distributed via a supply chain attack on four Laravel Lang PHP Composer packages. Attackers injected a dropper that silently downloaded the stealer when developers installed the affected package versions.

More broadly, threats of this type also reach victims through phishing emails, malicious downloads, pirated software, and compromised software installers.

Will Combo Cleaner protect me from malware?

Yes. Combo Cleaner can detect and remove most known malware. Because high-risk threats can sometimes hide deeply in the system, a full system scan is recommended to ensure the infection is fully removed.