Full Report
Infostealers are harvesting credentials and session cookies at scale, bypassing traditional defenses. Lunar explains why simple breach monitoring alone can't keep up with modern credential-based attacks. [...]
Analysis Summary
# Tool/Technique: Infostealer Malware Ecosystem
## Overview
Infostealers are a specialized class of malware designed to exfiltrate sensitive data from infected hosts. Unlike traditional data breaches that involve database leaks, infostealers harvest live data directly from user devices, including credentials, session cookies, and system metadata. This enables attackers to bypass Multi-Factor Authentication (MFA) by utilizing stolen session tokens to "hijack" established browser sessions.
## Technical Details
- **Type:** Malware Family / Malware-as-a-Service (MaaS)
- **Platform:** Windows, macOS
- **Capabilities:** Credential harvesting, session cookie theft, crypto-wallet extraction, automated exfiltration to C2/Telegram, hardware/software profiling.
- **First Seen:** Continuous evolution; significant surges noted through 2025-2026.
## MITRE ATT&CK Mapping
- **[TA0006 - Credential Access]**
- [T1539 - Steal Web Session Cookie]
- [T1555 - Credentials from Password Stores]
- [T1555.003 - Credentials from Web Browsers]
- **[TA0009 - Collection]**
- [T1005 - Data from Local System]
- **[TA0011 - Command and Control]**
- [T1105 - Ingress Tool Transfer]
- [T1102.002 - Web Service: Bidirectional Communication (Telegram)]
- **[TA0005 - Defense Evasion]**
- [T1070 - Indicator Removal]
## Functionality
### Core Capabilities
- **Browser Hooking:** Extraction of autofill data, saved passwords, and credit card information from Chromium and Geck-based browsers.
- **Session Hijacking:** Stealing active session cookies, allowing attackers to impersonate users in SaaS applications (e.g., Slack, AWS, Salesforce) without needing MFA.
- **System Discovery:** Collecting IP addresses, OS versions, installed software, and hardware specifications.
### Advanced Features
- **MaaS Infrastructure:** Comprehensive dashboards for attackers to filter, search, and download "logs" (stolen data packages).
- **Stealer-Derived Combolists:** Automated generation of credential sets from multiple infections for mass-credential stuffing.
- **Cross-Platform Variants:** Specialized malware for macOS targeting crypto-wallets and keychain data.
## Indicators of Compromise
- **File Names:** Frequently disguised as software cracks, "leaked" installers, or job-related PDFs.
- **Network Indicators:**
- Exfiltration to Telegram API endpoints (e.g., `api[.]telegram[.]org/bot...`)
- Connection to known C2 panels (e.g., Lumma C2 domains).
- **Behavioral Indicators:**
- Unauthorized access to browser profile folders (e.g., `\AppData\Local\Google\Chrome\User Data\Default`).
- Sudden execution of PowerShell or CMD scripts from temporary directories.
## Associated Threat Actors
*Note: Infostealers are widely used by both sophisticated APTs and low-level cybercriminals via MaaS.*
- **Malware Families mentioned:** LummaC2, Rhadamanthys, Vidar, Acreed.
- **macOS Specific Families:** Atomic macOS Stealer (AMOS), Odyssey, MacSync, MioLab, Atlas.
## Detection Methods
- **Signature-based:** Monitoring for known hashes of stealer binaries and DLLs.
- **Behavioral detection:** Inspecting processes that attempt to read browser "Login Data" SQL databases or "Cookies" files.
- **Network Monitoring:** Identifying unusual outbound traffic to Telegram bots or high-frequency POST requests to unrecognized external domains.
- **Dark Web Monitoring:** Scanning for corporate domain credentials in "logs" or "combolists" traded on underground forums.
## Mitigation Strategies
- **Token Invalidation:** Force global sign-outs and session resets if an infostealer infection is detected on a device.
- **Endpoint Protection:** Implementing robust EDR/AV on all devices, including unmanaged/home devices used for work.
- **Zero Trust:** Limiting session lifetimes and implementing device compliance checks for SaaS access.
- **Hardware Security:** Utilizing hardware-bound passkeys which are significantly more resistant to stealer extraction than traditional passwords and cookies.
## Related Tools/Techniques
- **Credential Stuffing:** Using stolen logs to attempt logins across various platforms.
- **Cookie Hijacking (Pass-the-Cookie):** The specific technique of using stolen session tokens to bypass authentication.
- **Dark Web Monitoring Platforms:** Tools like Lunar used for forensic investigation and early detection of exposed credentials.