What is an infostealer? What it steals, how it infects and how to detect it in your company

What is an infostealer and how does it work?

An infostealer (short for information stealer) is malware that copies credentials and other valuable data from the infected computer and sends them to the attacker. Many are sold or rented as a service (malware as a service) to affiliates who run their own campaigns. This is the model Microsoft describes for Lumma.

1. Infection: the victim runs something, almost always after being tricked.
2. Collection: within seconds, it reads the browser's password and cookie stores, cryptocurrency wallets and data from other applications.
3. Exfiltration: it packages the data and sends it to its command and control (C2) server. According to CISA, LummaC2 runs in memory and, unless its server instructs it to do anything else, does not create files on disk.
4. Sale: the package from each computer, known as the log, is sold on dark web marketplaces and Telegram channels.
5. Use: the buyer logs into the accounts, resells the access or uses it for fraud, extortion or ransomware.

What does an infostealer steal?

For a company, the most dangerous item is the session cookie. MITRE notes that it can be used to bypass some multi-factor authentication mechanisms, because the session was started with MFA already completed. Until it expires or is revoked, the attacker gets in as if they were the user.

How does an infostealer infect a computer?

• Fake CAPTCHAs or ClickFix: a website asks you to press Win+R (or open Terminal on a Mac), paste some text and press Enter. That text is a command, often encoded PowerShell. In 2025, MITRE created a sub-technique for this trick: T1204.004, Malicious Copy and Paste.
• Malicious search engine ads that lead to a copy of a program's official website with an infected installer.
• Pirated software, cracks, video game cheats and fake installers for AI tools.
• Phishing with fake invoices, bookings or shipping notices.
• Compromised legitimate websites and other malware. Microsoft has seen the DanaBot loader install Lumma.

For many companies, the blind spot is the personal computer. Verizon's 2025 DBIR estimated that 46% of infostealer-infected systems holding corporate credentials were not managed by the company. These are computers from which someone opens their email or the VPN, beyond the reach of the EDR.

Which infostealer families are the best known?

Why is an infostealer the entry point for so many attacks?

Because it delivers valid access. According to the M-Trends 2025 report from Mandiant (Google), in 2024 stolen credentials became for the first time the second most common initial access vector in its investigations (16%), behind vulnerability exploitation (33%), and Mandiant attributes this to the rise of infostealers. In the 2026 edition, based on 2025 data, Mandiant also notes that attackers collect OAuth tokens and long-lived session cookies to get around cloud defenses. Sophos describes the usual chain: the infostealer steals, an initial access broker validates and resells, and a ransomware affiliate or a business email compromise (BEC) group exploits the access.

And the theft can be exploited years later. In the 2024 campaign against Snowflake customers, Mandiant found that at least 79.7% of the accounts used had previously exposed credentials, mainly from infostealers such as Vidar, RedLine or Lumma, some dating back to 2020. The affected accounts did not have MFA.

How can you tell if a computer has an infostealer?

The EDR only sees the computers where it is installed, so monitoring identity and external sources matters as much as monitoring the endpoint.

How do you protect your company from infostealers?

• Use a corporate password manager instead of the browser.
• Require a managed device to access corporate applications. A credential stolen from a personal computer then loses almost all its value.
• Use phishing-resistant MFA (FIDO2 or passkeys) and protect sessions with short lifetimes, fast revocation and device binding. Since late May 2026, Google has enabled Device Bound Session Credentials (DBSC) by default in Chrome for Windows, which bind the session cookie of Google accounts to the computer where the session started.
• Keep the EDR in block mode with tamper protection, as Microsoft recommends against Lumma.
• Apply application control with allowlists, as CISA advises against LummaC2, and restrict PowerShell, the Run dialog and software installation to those who need them.
• Train staff with one specific message: no legitimate website will ever ask you to paste a command into your computer.
• Continuously monitor whether credentials from your domain appear in infostealer logs.

What should you do if you detect an infostealer on a computer?

1. Isolate the computer from the network and preserve evidence (alerts, the file or command that was run, the approximate time) before reinstalling.
2. From a clean computer, change every password saved in that browser, starting with email, VPN and admin accounts.
3. Revoke active sessions in your identity provider and SaaS applications. Changing the password does not always invalidate stolen cookies.
4. Review everything that has happened since the infection date: sign-ins, newly added MFA methods, mailbox rules and new OAuth applications.
5. Reinstall the computer from a clean image. If you need guidance and you are in Spain, INCIBE, the Spanish National Cybersecurity Institute, offers free help on its 017 helpline. If the incident is still ongoing, get professional help.

How Ciberia helps

Ciberia Intel brings together our own and third-party intelligence on credentials and infostealers, the dark web and forums, and Ciberia CTM continuously monitors your organization's leaked credentials, with alerts that come with context and a recommended action. If the infection happens inside your network, Ciberia MDR monitors the telemetry you already have 24/7, with a contractual SLA of 15 minutes from critical alert to initial containment.