Family comparison

RedLine StealerVidarLumma Stealer
Capability
RedLine StealerActive
VidarActive
Lumma StealerActive
PlatformWindowsWindowsWindows
Dark Radar infection records10,592,8185,662,0816,485,618
Credentials
Browser passwordsVerifiedVerifiedVerified
Session cookiesVerifiedVerifiedVerified
Refreshing expired sessions——Reported
AutofillVerifiedVerifiedVerified
macOS Keychain———
2FA and password managers—VerifiedVerified
Financial
Saved cardsVerifiedVerifiedVerified
Desktop crypto walletsVerifiedVerifiedVerified
Wallet extensionsVerifiedVerifiedVerified
Clipboard address replacement———
Applications
Email clientsVersion-dependent—Version-dependent
FTP clientsVerifiedVersion-dependent—
VPN clientsVerified——
Messaging applicationsVerifiedVersion-dependentVersion-dependent
Gaming platformsVerifiedDark Radar observationDark Radar observation
System
File collectionVerifiedVerifiedVerified
ScreenshotVerifiedVerified—
System inventoryVerifiedVerifiedVerified
Behavior
Additional payload downloadVerifiedVerifiedVerified
Persistence———
Anti-analysis—VerifiedVerified
Verified
Version-dependent
Reported
Dark Radar observation
Not observed