Academy
TermMalware type

Infostealer

Malware that collects passwords, session cookies, card and wallet data on the infected device and sends them to the attacker.

Flow

  1. 1Infects
  2. 2Collects
  3. 3Sends
  4. 4Circulates as a log
Related families
Lumma Stealer, RedLine Stealer, Vidar, StealC
MITRE ATT&CK
T1555.003 · Credentials from Web Browsers
Sources
8 sources
01

Overview

An infostealer does not try to persist; it often runs for a few seconds, reads browser databases and wallet files, sends the result in a single archive and deletes itself. Because it leaves little trace, the infection often goes unnoticed. MITRE ATT&CK

Its impact is not limited to the device. Passwords and sessions of corporate accounts can also be stolen from a personal computer; in the Snowflake incident, the initial infections were on contractor computers also used for gaming and unlicensed software. Google Cloud (Mandiant)

02

How it works

  1. 1

    Infects

    Unlicensed software, fake updates, sponsored ads or a fake verification page that makes the user paste a command. CISA and FBI (AA25-141B)

  2. 2

    Collects

    Browser passwords and cookies, wallets, messaging sessions, system information. MITRE ATT&CK

  3. 3

    Sends

    Uploads the archive to the command and control server or a Telegram bot. MITRE ATT&CK

  4. 4

    Circulates as a log

    The data is sold on markets and used for account takeover. CISA and FBI (AA25-141B)

03

Real-world examples

RedLine and META: Operation Magnus

RedLine Stealer profile

On 28 October 2024, the Dutch National Police, together with the FBI and international partners, disrupted the operation of the RedLine and META infostealers. Dutch National Police

04

How to detect it

  • A non-browser process reading the “Login Data” and “Cookies” files in browser profiles. MITRE ATT&CK
  • The organization’s domains appearing in stealer logs, even if the infection is on a device outside the organization. Google Cloud (Mandiant)
05

What to do

  • Turn off password saving in the browser; use a corporate password manager. MITRE ATT&CK
  • When an infection is detected, revoke all sessions and access keys. MITRE ATT&CK
  • Enforce multi-factor authentication and restrict access to critical systems to trusted networks. Google Cloud (Mandiant)
06

MITRE ATT&CK

T1555.003Credentials from Web BrowsersT1539Steal Web Session CookieT1082System Information DiscoveryT1041Exfiltration Over C2 Channel
07

Related families and terms

Families

Lumma StealerActiveRedLine StealerActiveVidarActiveStealCActive

Report

Infostealer Threat Report — October 2026

Terms

Stealer logsCommand and control serverMalware familySession hijacking
08

Sources

  1. 1Credentials from Web Browsers (T1555.003) · MITRE ATT&CK
  2. 2Steal Web Session Cookie (T1539) · MITRE ATT&CK
  3. 3System Information Discovery (T1082) · MITRE ATT&CK
  4. 4Exfiltration Over C2 Channel (T1041) · MITRE ATT&CK
  5. 5UNC5537 targets Snowflake customer instances · Google Cloud (Mandiant), 2024
  6. 6Threat Actors Deploy LummaC2 Malware to Exfiltrate Sensitive Data from Organizations · CISA and FBI (AA25-141B), 2025-05-21
  7. 7Operation Magnus · Dutch National Police, 2024-10-28
  8. 8Disrupting Lumma Stealer: Microsoft leads global action against favored cybercrime tool · Microsoft On the Issues, 2025-05-21
From the Essential plan

Infostealer Detection

See your firm's attack surface on one screen: how many findings, at which severity, on which domain.

View productCompare plans