Academy
TermUnderground market

Malware-as-a-Service

(MaaS)

A business model in which malware is rented out by its developer on a subscription and the customer only handles distribution.

Flow

  1. 1Developer sells
  2. 2Customer distributes
  3. 3Logs accumulate in the panel
  4. 4Developer updates
Related families
Lumma Stealer, Raccoon Stealer, Atomic macOS Stealer (AMOS)
MITRE ATT&CK
T1588.001 · Obtain Capabilities: Malware
Sources
7 sources
01

Overview

In the MaaS model, the developer provides the code, the panel, the server infrastructure and updates; the customer distributes the malware and collects the logs. Raccoon Stealer, for example, was rented for 75 dollars a week or 200 dollars a month. Malpedia (Fraunhofer FKIE)

Most of the major families on the infostealer market work this way: Lumma, Raccoon, StealC and Atomic macOS Stealer were sold on subscription. Malpedia (Fraunhofer FKIE)

02

How it works

  1. 1

    Developer sells

    Packages by period and feature are advertised on forums or Telegram. SentinelOne

  2. 2

    Customer distributes

    The customer spreads their build through fake software sites, ads or phishing emails. Trend Micro

  3. 3

    Logs accumulate in the panel

    Each customer sees only the logs from their own build.

  4. 4

    Developer updates

    Encryption and obfuscation methods are renewed constantly to avoid detection; if infrastructure is taken down, it is rebuilt. Trend Micro

03

Real-world examples

04

How to detect it

  • Builds of the same family belonging to different customers talk to different servers, and the servers change often; family detection should not depend on a single address list. Trend Micro
05

What to do

  • Cut off distribution channels: unlicensed software, sponsored search results and installers downloaded from unknown GitHub repositories. Trend Micro
06

MITRE ATT&CK

T1588.001Obtain Capabilities: Malware
07

Related families and terms

Families

Lumma StealerActiveRaccoon StealerActiveAtomic macOS Stealer (AMOS)Active

Report

Infostealer Threat Report — October 2026

Terms

TrafferBotnet panel rentalBuilderThreat actor
08

Sources

  1. 1Obtain Capabilities: Malware (T1588.001) · MITRE ATT&CK
  2. 2Raccoon Stealer — family entry and report index · Malpedia (Fraunhofer FKIE)
  3. 3Lumma Stealer — family entry and report index · Malpedia (Fraunhofer FKIE)
  4. 4Atomic Stealer threat actor spawns second variant · SentinelOne
  5. 5Fake installers drop malware · Trend Micro, 2021
  6. 6Lumma Stealer returns · Trend Micro, 2025
  7. 7Eternity Project: MaaS goes on and on · BlackBerry, 2022
From the Essential plan

Infostealer Detection

See your firm's attack surface on one screen: how many findings, at which severity, on which domain.

View productCompare plans