Infostealer

How it works

Infostealers reach devices in several ways. Troy Hunt describes a typical case: a victim downloads pirated software, and a trojan comes with it. Once running, the malware reads what the browser has stored and captures credentials as they are entered into websites. MITRE ATT&CK lists RedLine, Raccoon and Lumma Stealer among the malware that takes saved credentials from web browsers, and tracks theft of web session cookies as a separate technique.

The malware does not need to break any password. It reads the data where the user already keeps it, or captures it as it is entered. It then bundles the haul and sends it to the operator.

How it shows up in executive exposure

The output of an infostealer is a stealer log. MITRE ATT&CK notes that adversaries may buy credentials on dark web markets or through Telegram channels that distribute infostealer logs. Group-IB lists infostealer logs among the sources that combolists and ULP lists are compiled from. An executive who signs in to work accounts on a personal or unmanaged device carries this risk without any sign of trouble.

EDG3, WebThreat's threat intelligence for leaked data, watches the dark web forums, Telegram channels and marketplaces where stealer logs are posted and sold. CEM shows which executives already appear in breach corpora and leak databases.

How to reduce the risk

MITRE's mitigations for related techniques include these steps:

• Keep browsers and password managers updated.
• Use hardware-based multi-factor authentication, which resists proxy-based cookie theft.
• Weigh the risk of storing credentials in the browser, and prevent it where that risk is significant.
• Train users to spot phishing pages and not to run untrusted code in the browser.
• Limit browser extensions and third-party cookies.

How it differs from related terms

An infostealer is the malware. A stealer log is the data it produces. A credential pair is one record inside such a log. Session cookie theft is one of the things many infostealers do, and it can bypass a password entirely. A breach of a service is a different event: there the service loses data, rather than the user's own device. See combolists vs stealer logs vs database dumps.