Infostealers

Infostealers

Executive Summary

Infostealer malware has become one of the most consequential threats in the cybercrime ecosystem, serving as a foundational enabler for ransomware, account takeover, corporate network intrusion, and financial fraud. These malware families operate under a Malware-as-a-Service (MaaS) model, with developers offering subscriptions ($100-$300/month) that include the malware builder, a management panel, and regular updates to evade detection. Upon execution, infostealers harvest browser-stored credentials, session cookies, cryptocurrency wallet data, autofill data, and system information, packaging the results into "logs" that are then sold on dedicated marketplaces or used directly by the operator.

The log marketplace ecosystem is substantial. Russian Market has emerged as the dominant platform for purchasing individual infostealer logs, following the law enforcement takedown of Genesis Market in April 2023 (Operation Cookie Monster). Genesis Market had been unique in selling persistent "bot" access that included browser fingerprints, enabling buyers to impersonate victims' browser sessions. Telegram channels also serve as major distribution points for both bulk and individual log sales. A single high-value corporate log — containing VPN credentials, SSO session cookies, or cloud service tokens — can sell for $10-$500, while bulk residential logs sell for as little as $1-$10 each.

The connection between infostealers and ransomware operations has tightened significantly. Initial Access Brokers (IABs) systematically harvest corporate VPN, RDP, and Citrix credentials from infostealer logs and resell this access to ransomware affiliates. Many ransomware incidents can be traced back to credentials originally stolen by infostealers months earlier. Distribution methods have evolved from traditional email spam to sophisticated SEO poisoning campaigns, malvertising through Google Ads, and trojanized software downloads, making infostealers a pervasive threat that affects both individual consumers and enterprises.

Key Actors

Current Activity

Lumma Stealer's Market Dominance (2024-2025)

Following the disruption of RedLine in Operation Magnus (October 2024), Lumma Stealer has emerged as arguably the most prevalent infostealer family. Lumma offers tiered subscriptions with advanced features including persistent cookie restoration (attempting to revalidate expired session cookies), corporate log filtering, and sophisticated anti-analysis techniques including C2 domain rotation and encrypted communications. Distribution campaigns leverage Google Ads malvertising, fake CAPTCHA pages, and trojanized software download sites at scale.

Operation Magnus — RedLine/META Disruption (October 2024)

In October 2024, an international law enforcement operation led by Dutch police disrupted the infrastructure of RedLine Stealer and the related META Stealer. The operation seized servers, domains, and Telegram channels used for distribution and sales. While significant, the infostealer ecosystem quickly adapted, with operators migrating to Lumma, StealC, and other alternatives, demonstrating the resilience of the MaaS model.

macOS Stealer Proliferation

The emergence and growth of macOS-targeting infostealers (Atomic Stealer/AMOS, Meta Stealer for macOS, Poseidon/RodriguesDecryptor) represents a significant shift. These stealers target Keychain passwords, browser data, cryptocurrency wallets, and files. Distribution primarily occurs through malvertising campaigns impersonating legitimate software downloads (Arc browser, Notion, etc.) and through DMG files distributed via social engineering.

Historical Events

TTP Evolution

Distribution Methods: The evolution from email spam attachments (2020-2021) to sophisticated distribution via SEO poisoning, Google Ads malvertising, and fake software download sites (2023-present) represents a major shift. Current campaigns create convincing fake websites for popular software (Slack, Zoom, OBS Studio, various gaming tools) that rank in search results or appear in sponsored ad positions. The "fake CAPTCHA" technique emerged in 2024, where malicious sites present a verification challenge that instructs users to open Run dialog (Win+R) and paste a PowerShell command that downloads the stealer.

Anti-Analysis: Modern stealers employ VM/sandbox detection, anti-debugging, string encryption, and control flow obfuscation. Lumma and Rhadamanthys use sophisticated techniques including trigonometric calculations for execution delays (evading sandbox timeouts), heavy API call obfuscation, and dynamic C2 resolution via DNS-over-HTTPS or blockchain-based dead drops.

Data Targeting: Beyond traditional browser credentials and cookies, modern stealers target: cryptocurrency wallet extensions and desktop wallets, 2FA authenticator app databases, VPN client credentials (corporate targets), email client data, Discord/Telegram session tokens, gaming platform credentials (Steam, Epic), and increasingly files matching patterns (documents, PDFs, private keys).

Cookie/Session Theft: Session cookie theft has become as valuable as credential theft, enabling authentication bypass that circumvents MFA entirely. Chrome's App-Bound Encryption (introduced 2024) attempted to protect cookies, but stealer developers developed bypasses within weeks, highlighting the arms race between browser security and stealer development.

Log Processing and Sale: Stolen data is processed through automated panels that parse, categorize, and extract high-value items. Logs are tagged by country, affected services (banking, social media, corporate), and data completeness. Automated filtering for corporate VPN credentials (Cisco AnyConnect, Fortinet, Pulse Secure) feeds the IAB pipeline.

Ecosystem & Infrastructure Patterns

MaaS Business Model: Infostealer developers operate subscription-based services with tiered pricing. Higher tiers may include features like log parsing tools, dedicated support, custom builds, and access to private Telegram channels with updates. Developers invest in marketing on cybercrime forums, often providing test builds and comparison demonstrations against competitors.

Log Market Pipeline: Stolen logs flow through a multi-stage pipeline: stealer deployment → log collection at C2 panel → automated parsing and categorization → listing on marketplaces (Russian Market, Telegram channels, 2easy) or private buyer arrangements → purchase by IABs, fraudsters, or direct operators → exploitation for account takeover, fraud, or network intrusion.

Russian Market Dominance: Following the Genesis Market takedown, Russian Market consolidated its position as the leading log marketplace. It offers search by URL (finding credentials for specific services), geographic filtering, and stealer family filtering. The marketplace maintains automated listing from multiple stealer operators.

Infostealer-to-Ransomware Pipeline: The operational chain from infostealer infection to ransomware deployment is well-documented: (1) Employee machine infected with infostealer via malvertising, (2) Corporate VPN/SSO credentials stolen, (3) Credentials appear on log markets, (4) IAB purchases and validates access, (5) IAB sells access on forums (Exploit, XSS, RAMP), (6) Ransomware affiliate purchases access and deploys ransomware. This chain can span weeks to months.

Tooling

Intelligence Gaps

• Corporate impact quantification: The total number of corporate breaches and ransomware incidents directly attributable to infostealer-harvested credentials is not well-quantified, though anecdotal evidence suggests it is substantial.
• Log market volumes: Total volume and revenue of log marketplaces is estimated but not precisely measured; many transactions occur in private channels.
• Chrome cookie encryption effectiveness: The ongoing arms race between browser cookie protection and stealer bypass techniques creates rapidly shifting intelligence that is difficult to keep current.
• macOS stealer prevalence: The actual infection rates and impact of macOS-targeted stealers are less well-studied compared to Windows stealers due to lower telemetry and research focus.
• Mobile infostealer convergence: The overlap between traditional desktop infostealers and mobile banking trojans (which also steal credentials) is not well-mapped as the ecosystems converge.

Sources & References

1. Dutch National Police - "Operation Magnus: RedLine and META Stealer Disruption" (October 2024) — https://www.politie.nl/
2. FBI/Europol - "Operation Cookie Monster: Genesis Market Takedown" (April 2023) — https://www.fbi.gov/
3. Sekoia - "Infostealer Landscape" threat reports — https://blog.sekoia.io/
4. Recorded Future - "Infostealer Marketplace Intelligence" — https://www.recordedfuture.com/
5. KELA - "Infostealer-to-Ransomware Connection Analysis" — https://www.kelacyber.com/
6. Flare - "Infostealer Log Market Analysis" — https://flare.io/
7. Google Threat Analysis Group - "Malvertising Campaign Disruptions" — https://blog.google/threat-analysis-group/
8. Trend Micro - "Infostealer Family Tracking Reports" — https://www.trendmicro.com/vinfo/us/security/research-and-analysis/

Change Log