InfoStealers & Credential Harvesters
Threat Landscape & Operational Overview
Information Stealers (InfoStealers) are purpose-built malware strains designed to rapidly exfiltrate sensitive local data from compromised workstations. Widely distributed through Malware-as-a-Service (MaaS) operations (e.g. RedLine, Raccoon, Vidar, AgentTesla, Lumma), InfoStealers target Chromium and Gecko browser SQLite vaults, stored passwords, autofill data, cryptocurrency wallet extensions, Telegram and Discord desktop sessions, VPN configurations, and SSH private keys. The exfiltrated credential caches—frequently packaged as 'stealer logs'—are traded on dark web marketplaces and used as initial access brokers (IAB) for enterprise ransomware intrusions.
🛡️ Enterprise Incident Response & Hardening Guidance
Dealing with an active security incident or looking to harden enterprise defenses against this threat class? Read our dedicated operational engineering guide:
→ Open Master Guide: InfoStealer Protection & RemediationPrimary MITRE ATT&CK Tactics & Techniques
Observed technical tradecraft, privilege escalation, and persistence patterns mapped across threat families in this category:
| ID | Technique | Tactic | Observed Operational Behavior |
|---|---|---|---|
T1555.003 |
Credentials from Web Browsers | Credential Access | Extracts stored passwords and cookie vaults from Chrome, Edge, Brave, and Firefox. |
T1552.001 |
Credentials In Files | Credential Access | Searches desktop files and AppData for crypto wallets, seed phrases, and SSH keys. |
T1005 |
Data from Local System | Collection | Aggregates machine identifiers, installed software, and system telemetry into a staging archive. |
T1041 |
Exfiltration Over C2 Channel | Exfiltration | Transmits zipped stealer logs to operator C2 endpoints or Telegram bots. |
T1070.004 |
File Deletion | Defense Evasion | Deletes loader artifacts and temporary staging files upon successful exfiltration. |
Actively Weaponized Exploits & Vulnerabilities (15 CVEs)
Adversaries deploying infostealers & credential harvesters frequently weaponize the following software vulnerabilities for initial ingress, privilege escalation, or lateral movement:
Microsoft Windows PCT / SSL Handshake Buffer Overflow
Attributed Payloads: berbew
Microsoft Windows LSASS Buffer Overflow (Sasser Worm)
Attributed Payloads: berbew
Microsoft Office MSCOMCTL.OCX ActiveX TreeView / ListView Buffer Overflow
Attributed Payloads: ardamax, cosmicduke, fareit +5 more
Microsoft Office Discretionary Memory Corruption Vulnerability (MS15-033)
Attributed Payloads: khalesi, urelas
Microsoft Windows Shell Shortcut LNK / PIF Code Execution (Stuxnet)
Attributed Payloads: olgames, qqpass
Microsoft Office RTF pFragments Stack Buffer Overflow
Attributed Payloads: cosmicduke
Microsoft MSHTML Engine Remote Code Execution Vulnerability
Attributed Payloads: redline
Microsoft Windows SmartScreen Defense Evasion Vulnerability
Attributed Payloads: lumma
SOC Incident Containment Checklist
Standard operating triage procedure for security teams responding to suspicious or confirmed infections in this category:
- Force an immediate enterprise-wide password and session revocation for all compromised user accounts.
- Invalidate all active session cookies and refresh tokens for Google Workspace, Microsoft 365, AWS, and corporate VPNs.
- Rotate any SSH keys, API tokens, or cryptographic wallets stored on the affected workstation.
- Analyze dark web telemetry and initial access broker forums to determine if stealer logs have been published.
- Deploy endpoint controls blocking untrusted executable downloads and unauthorized access to browser AppData directories.
- Do not rely solely on password changes; stealers capture session cookies that bypass MFA entirely.
- Do not leave local browser password autofill enabled on enterprise workstations.
Prominent Malware Families in this Category
Top documented threats ranked by historical prevalence and behavioral signatures:
fareit
Fareit (widely recognized across the threat intelligence community as Pony or Pony Stealer) is one of the most influential and pervasive ...
razy
Razy (cataloged across cybersecurity research as Trojan:Win32/Razy, Trojan.Win32.Razy, and Trojan.Razy.gen) is a sophisticated Windows tr...
azorult
AZORult is an infamous, highly efficient commodity information stealer and malware downloader first commercialized in 2016 by Russian und...
ribaj
Trojan:Win32/Ribaj (also cataloged in security telemetry as Trojan:MSIL/Ribaj, Win32/Ribaj, or Trojan.Ribaj) is an evasive credential-ste...
urelas
Trojan:Win32/Urelas is a specialized information stealer and credential extraction trojan engineered to harvest authentication credential...
hawkeyekeylogger
HawkEye Keylogger (also tracked as HawkEye, HawkEye Reborn, and Spyware.HawkEye) is a commercial .NET surveillance toolkit and credential...
qqpass
Trojan-PSW.Win32.QQPass (broadly cataloged in antivirus telemetry as PWS:Win32/QQPass) is an aggressive, specialized password stealer eng...
msilperseus
MSIL/Perseus (identified in endpoint telemetry as Trojan:MSIL/Perseus, Trojan.MSIL.Perseus, and MSIL/Perseus.A) is a modular .NET-based i...
Complete Directory (55 Families)
Alphabetical index of all tracked malware families cataloged under infostealers & credential harvesters:
- adspy
- advpassman
- agenttesla
- allinonekeylogger
- ardamax
- arkeistealer
- atraps
- azorult
- banspy
- barys
- berbew
- beyondkeylogger
- blackstealer
- browserpassview
- browserpwdstealer
- bypass
- cardspy
- chisburg
- coinstealer
- cosmicduke
- dimnie
- dothetuk
- eyestye
- fareit
- hawkeyekeylogger
- hploki
- khalesi
- ldpinch
- lmir
- lokibot
- lumma
- lynx
- mintluks
- msilperseus
- olgames
- papras
- pirminay
- pony
- ponystealer
- qqpass
- raccoon
- razy
- redline
- ribaj
- socelars
- spytector
- stealc
- steam
- universal1337
- urelas
- usteal
- vidar
- wsgame
- yunsip
- zapchast