Infostealers: The Silent Smash-and-Grab Driving Modern Cybercrime

Infostealers have become the fulcrum of modern cybercrime, enabling stealthy data harvesting and rapid, mass-scale exfiltration. The article explains that these MaaS-enabled tools broaden the attacker base by allowing non-experts to deploy effective credential-stealing operations and to bundle stolen data into logs for sale on underground markets.

Prominent families such as RedLine, Lumma, and Raccoon are used by thousands of operators, with MaaS platforms offering management panels, 24/7 support, and regular updates to maximise reach and efficiency.

Phishing remains a key delivery method, with fake CAPTCHAs and social engineering used to load infostealers into memory, after which data such as browser data, VPN credentials, and other sensitive information can be compressed, encrypted, and sent to attacker-controlled destinations like Telegram, Dropbox, or Google Drive.

The article notes real-world impact, including UNC5537 using stolen credentials from infostealer campaigns to access Snowflake customer instances in April 2024, and Mandiant reporting that stolen credentials were used for initial access in 16% of incidents in 2024. According to Google Threat Intelligence Group, the activity is expanding and could signal shifts in how criminals monetise data obtained from infostealers.