Infostealers Tied to Stolen AI and Defense Credentials

Organizations across the defense sector including military agencies, show signs of having been infected by information-stealing malware.

See Also: Top 10 Technical Predictions for 2025

Victims of infostealers in recent years have included at least 398 employees of defense giant Honeywell, 66 employees of Boeing, and 55 employees each at Leidos and Lockheed Martin, says a report from threat intelligence firm Hudson Rock. A review of stolen data for sale on cybercrime markets found that other infostealer-infected organizations include the U.S. Army, with 71 infected employees, as well as the U.S. Navy with 30 and FBI with 24.

Based on the specific types of credentials being sold, Hudson Rock researchers say buyers theoretically could have gained access to a variety of sensitive corporate systems, including at remote access VPNs as well as Active Directory Federation Services, Salesforce, SAP and SharePoint software.

Infostealers automate the process of infecting a system and exfiltrating any and all data of interest. These tools oftentimes get designed to siphon off session cookies passwords for services and sites – including cryptocurrency wallets and for VPN access – as well as sensitive documents. They also can raid password managers, obtain access to financial accounts and development environments.

Information stolen from a single system gets batched up into what’s known as a log, which hackers can use themselves to directly target victims or sell it on to others. The market for logs remains thriving, with sales taking place via highly automated “clouds of logs” platforms, as well as on other cybercrime markets and via Telegram channels.

AI Credentials for Sale

Anytime a big set of stolen credentials hits the market, researchers say infostealers are often involved, even if sellers don’t say so.

A set of OpenAI credentials advertised for sale earlier this month on BreachForums by the user account “emerking” claimed to have been gathered by a hack of the AI research and deployment company, based in San Francisco, California, said threat intelligence firm Kela.

Based on its analysis of 30 sample credentials that emerking shared as part of the listing, Kela said they all traced to accounts it cataloged as having been compromised by infostealers. Emerking has previously discussed infostealer logs in BreachForums posts.

Exposed credentials for AI services abound. “For reference, in 2024 alone Kela collected more than 3 million compromised accounts belonging to OpenAI users, as well as 174,000 accounts belonging to Gemini users,” it said, latterly referring to Google’s AI model.

‘Key Enabler’

The information amassed by infostealers serves as “a key enabler for various types of cyberattacks such as ransomware deployment, corporate espionage, account takeover, business email compromise, money laundering, fraud and many other evolving attack vectors,” said Leonid Rozenberg, a threat researcher at Hudson Rock.

The most recent Verizon Data Breach Investigations Report found that from 2013 through 2023, the use of stolen credentials featured in 31% of all known breaches, and in 2023 accounted for 77% of attacks against web applications.

“Cybercriminals continuously upgrade their capabilities by sourcing tools, services and knowledge from various underground forums, primarily in Russian and English languages,” said the Hudson Rocks report.

For criminals, malware-as-a-service offerings – which charge users a subscription fee for access – remain the most popular way to access infostealers. Terms of service may stipulate that the operator gets to keep certain types of data, such as credentials for accessing cryptocurrency wallets. Such services can also help automate the process of batching up stolen information for sale, as well as enable users to avoid having to try and create and update such malware themselves.

Many infostealer operations work with “traffers,” which originated from the Russian word “tраффер,” also referred to as “worker” in the underground community.” A traffer essentially provides “lead generation” for botnet operators, said cybersecurity firm Sekoia.

Top tactics used by traffers to infect systems with infostealers include phishing emails, fake advertising campaigns disseminated via search engines, fake or hijacked social media accounts being used to perpetrate scams, as well as pirated software, Hudson Rock’s Rozenberg said.

Offerings: Redline Dominates

The most popular infostealer-as-a-service offering is Redline, reports Specops Software, part of Outpost24, in a recent report based on its study of 1 billion passwords stolen last year by infostealers. Other popular services included Vidar and Raccoon Stealer version 2, which respectively accounted for 17% and 12% of stolen credentials. Other popular offerings include Lumma, MetaStealer and StealC.

Law enforcement hasn’t been sitting idly by. Last October, an international operation led by Dutch police infiltrated and disrupted both the Redline and Meta infostealers, and seizing data pertaining to the traffers with which the groups work. Investigators are working to unmask Redline’s criminal users and associated “legal actions are underway,” Dutch police promised.

At the same time, the U.S. Department of Justice unsealed a complaint against Russian national Maxim Rudometov, accusing him of being one of the alleged developers and administrators of the Redline infostealer. He remains at large. A Ukrainian man pleaded guilty last December in U.S. federal court to being a key figure in the Raccoon infostealer operation, receiving a 60 month sentence (see: Key Raccoon Figure Receives 60-Month U.S. Prison Sentence).