Infostealer
information stealer · stealer · credential stealer · stealer logs · session cookie theft · voleur d’informations
Malware built to quickly steal saved passwords, session cookies, cryptocurrency wallets and browser data, which are then sold on criminal marketplaces.
In practice
An infostealer often runs for just a few seconds, sends off its haul and may then disappear. The stolen “logs” are sold individually: a corporate VPN login or cloud account is particularly attractive to ransomware gangs. Stolen session cookies can sometimes let attackers in without a password or multi-factor prompt. An employee’s personal computer, also used for work, is a frequent weak spot.
According to CISA and the FBI, more than 21,000 listings selling logs stolen by the LummaC2 infostealer appeared on criminal forums between April and June 2024. One of its lures was a fake CAPTCHA asking users to paste a command into Windows themselves.
How to protect yourself
- Do not save work passwords in the browser of a personal computer; use a password manager.
- Passkeys or FIDO2 keys on critical accounts, and sessions with a limited lifetime.
- As soon as an infection is suspected, revoke sessions and rotate the affected secrets.
- Raise awareness of fake CAPTCHAs and pirated software, two major infection routes.
