Infostealer Crash Course: How They Steal Data and Enable Further Attacks
Summary
A Huntress Tradecraft Tuesday recap explains infostealer evolution, the credentials and data they target, marketplace activity, macOS variants, recent takedowns, a detected Lumma incident, and ways businesses can reduce risk.
Key points
- Huntress says infostealers accounted for almost a quarter of the incidents its team saw last year, according to its 2025 Cyber Threat Report.
- Stolen data can include corporate credentials, session tokens, MFA codes, API keys, cloud credentials, financial information, and personal data; it may be sold for use in further attacks.
- After Banshee Stealer's source code leaked in November 2024, developers used it to create variants including FrigidStealer, FleshStealer, and Realst Stealer.
- The article describes law enforcement actions against RedLine and META infrastructure, the Cracked and Nulled marketplaces, and Lumma Stealer infrastructure.
- In a March 2025 incident, Huntress detected an executable disguised as Notion that misused Chrome remote debugging to extract cookies; a temporary file name was associated with Lumma Stealer.
- Infostealers may spread through malicious websites, phishing, or malvertising. The article recommends employee awareness, ad blockers, MFA, and EDR controls.
Article Details
- Topic
- Infostealer tradecraft, stolen-data marketplaces, and defensive measures
MITRE ATT&CK
T1059.002 · AppleScriptRealst is described abusing AppleScript to simulate Apple prompts while seeking user credentials.T1539 · Steal Web Session CookieThe article describes infostealers extracting browser cookies and targeting session tokens.T1547.001 · Registry Run Keys / Startup FolderRun Keys are identified as an indicator of infostealer activity.T1555.001 · KeychainmacOS infostealers target credentials stored in Apple Keychain.T1555.003 · Credentials from Web BrowsersInfostealers are described stealing credentials from Chromium-based and other web browsers.T1566 · PhishingPhishing emails are listed as a distribution method for infostealers.T1583.001 · DomainsThe article describes threat actors buying domains for Google-based malvertising campaigns.
People
Greg LinaresHuntress Principal Threat Intelligence Analyst who discussed infostealers in the Tradecraft Tuesday episode.Lindsey O'Donnell-WelchHuntress technical community engagement writer, episode participant, and article author.Maxim RudometovIdentified as a developer and administrator of RedLine infostealer; the US Department of Justice unsealed charges against him.
Threat Actors
Malware
AzoRultIn 2011, the source code of Zeus leaked, leading to the rapid expansion of infostealers like AZORult and HawkEye across the threat landscape (as we’ll see later in this blog, source code leaks and subsequent infostealerBanshee StealerThe Banshee Stealer source code leak and macOS stealersChromeloaderLumma Stealer is the second most common infostealer (behind ChromeLoader) that Huntress has observed over the last year.FleshStealerFleshStealer: Targets Chromium-based web browsers for credentials and cookies, as well as 2FA passwords or Wi-Fi network credentials FrigidStealerFrigidStealer: Targets Safari and Chrome credentials, Apple Notes documents, and crypto wallet dataHawkEyeIn 2011, the source code of Zeus leaked, leading to the rapid expansion of infostealers like AZORult and HawkEye across the threat landscape (as we’ll see later in this blog, source code leaks and subsequent infostealerLumma StealerMore recently, in May, Europol announced a law enforcement operation targeting Lumma Stealer, which disrupted its technical infrastructure with federal authorities seizing its infrastructure and control panel.METAIn October 2024, international authorities announced the takedown of the RedLine and META infostealer after seizing domains, servers, and Telegram accounts used by the infostealers’ administrators.RaccoonSoon, the true industrialization of infostealers began to take form, with power players like Raccoon, Vidar, and RedLine being built out.Realst StealerRealst Stealer: Targets macOS Keychain data, crypto wallet data, and Chromium-based browser information RedLineSoon, the true industrialization of infostealers began to take form, with power players like Raccoon, Vidar, and RedLine being built out.VidarSoon, the true industrialization of infostealers began to take form, with power players like Raccoon, Vidar, and RedLine being built out.ZbotIt all started with Zeus: A quick history of infostealers
Vendors
HuntressIt’s no wonder Huntress’ 2025 Cyber Threat Report found that infostealers represented almost a quarter of all incidents our team saw last year.MicrosoftThe operation was part of a public-private sector partnership effort, and Microsoft announced it had seized 2,300 domains linked to Lumma’s infrastructure.
Products
Google ChromeFrigidStealer: Targets Safari and Chrome credentials, Apple Notes documents, and crypto wallet dataiCloudmacOS infostealers primarily target Apple’s iCloud and Keychain, which are where most of the credentials are stored.KeychainRealst Stealer: Targets macOS Keychain data, crypto wallet data, and Chromium-based browser information SafariFrigidStealer: Targets Safari and Chrome credentials, Apple Notes documents, and crypto wallet dataSlackcybercriminals targeting information like multi-factor authentication (MFA) codes, as well as Discord and Slack credentials and logs.