Infostealers Run Wild – GovInfoSecurity

Credential theft driven by infostealers is reaching epidemic proportions as hackers adapt to more robust countermeasures by infecting corporations with malware that steals session cookies, allowing threat actors to bypass multifactor authentication.

See Also: Top 10 Technical Predictions for 2025

Threat intelligence firm Flashpoint estimated 5.8 million hosts and devices were infected by infostealers and over 1.8 billion credentials harvested during the first half of this year. Those credentials now circulate on illicit marketplaces and fuel identity-based attacks.

The firm traced the bulk of those infections to the Lumma Stealer, which has a reputation for being especially easy to use. Other top infostealers, which accounted for hundreds of thousands of infections each, included RedLine, Stealc, Vidar and Agent Tesla.

Infostealers harvest usernames, passwords and session tokens, allowing attackers to restore a victim’s active browser tabs and evade multifactor defenses. The output files from these infections, called infostealer logs, “have transformed such attacks into a pathway for gaining corporate network access and launching subsequent operations,” said Ian Gray, Flashpoint’s vice president of intelligence.

“A single log file can capture enough host and session information to enable attackers to move laterally through systems and achieve complete network compromise.”

A log, typically comprising up to a few megabytes of data, retails for as little as $10 on marketplaces, Gray said, although also get supplied through subscription services – typically on Telegram – that promise bulk, downloadable updates on a daily, weekly or some other basis.

Disruptions and Takedowns Continue

Law enforcement agencies have ramped up crackdowns against cybercrime operations and services tied to infostealers, including suppliers. This has included disrupting RedLine and Meta infostealers in October 2024 and Lumma in May, together with Microsoft, which involved taking down or blocking 2,300 malicious domains that hosted its infrastructure.

Highlighting the scale of these criminal operations, Microsoft said that from March 16 through May 16 alone, it identified over 394,000 Windows systems around the world infected by Lumma.

As with so many types of malware, truly disrupting infostealers is difficult, unless police can bust the operators involved. Many infostealer operations are likely run from Russia, which at least historically turned a blind eye to foreign-targeting cybercrime, and which never extradites citizens to face foreign charges.

Just days after being disrupted, Lumma resurfaced as a going concern. The operators said in a cybercrime forum post: “We quickly restored functionality and added more logging,” despite the FBI having apparently used a zero-day exploit against its servers and remotely wiping the drives.

While the disruption did lead to a decline in systems being targeted, “from June through July, the number of targeted accounts steadily returned to their usual levels, suggesting that Lumma Stealer operators were able to quickly reestablish their operations and resume previous targeting activity,” reported cybersecurity firm Trend Micro in a July 22 report.

Lumma’s operators added post-disruption refinements. “Now, the malware is distributed through more discreet channels and stealthier evasion tactics,” cited Trend Micro.

Infostealer Defenses

Infostealers depend heavily on social engineering to infect victim machines. These often feature offering fake cracks and key generators that purport to give people expensive software for free, sometimes through malicious GitHub repositories, as well as by using ClickFix campaigns designed to trick victims into running code that delivers and runs the malware, Trend Micro said.

Social media is another dominant attack vector. A Thursday report from Check Point Research details YouTube Ghost Network, launched in 2021, which recently grew to comprise 3,000 malicious videos distributed primarily through “Game Hacks/Cheats” and “Software Cracks/Piracy” categories.

Researchers recommend multiple strategies to defend against infostealers “User education remains a vital line of defense, individuals must be made aware of the risks associated with downloading software from unofficial sources and the deceptive tactics employed by cybercriminals,” Check Point said.

Overall, “cyber hygiene goes a long way,” Flashpoint’s Gray told Information Security Media Group. This includes not just MFA but also network segmentation and “permissioning,” such as bring-your-own-device access controls.

He likewise recommends using threat intelligence monitoring – a service his firm and many others offer – not least to sound an early alarm whenever corporate credentials get discovered in a cloud of logs. While some of those credentials may get used quickly, others may not get tapped until weeks, months or years later.