What Is Infostealer Malware?

Scope and definition

Infostealer malware denotes a class of software whose function is the bulk extraction of stored authentication material and associated data from a compromised host, followed by exfiltration to operator-controlled infrastructure.

The category is defined by what it does not do as much as by what it does. It does not encrypt data for extortion. It does not establish long-term remote access. It does not, in most cases, attempt lateral movement. It performs a single collection pass and exits.

This design is not a limitation but an optimization. Dwell time correlates with detection probability, and the data of interest — browser credential stores, cookie databases, wallet files — is available immediately on execution. Extending residency would increase risk without materially increasing yield.

Collection scope

A representative sample collects the following, generally in this order of priority:

Browser credential stores. Chromium-derived browsers persist saved credentials in a SQLite database (Login Data) with password fields encrypted. Firefox uses a separate scheme built on key4.db and logins.json.

Cookie stores. The complete cookie database, which is frequently the highest-value component. Session cookies represent authenticated state and can be replayed without knowledge of the underlying credential.

Autofill and form data. Postal addresses, telephone numbers, and in some configurations payment card data.

Cryptocurrency material. Wallet files for desktop clients, and the local storage of browser wallet extensions.

Targeted file collection. Directory traversal against user profile paths, filtering on extension and filename patterns — commonly documents containing strings such as password, seed, backup, or wallet.

Host profile. Hostname, operating system version, CPU and memory, installed application inventory, local and external IP, keyboard layout and locale, and domain membership where applicable.

Screen capture. A desktop screenshot at the moment of execution.

The last two categories are frequently overlooked in discussion of this malware, and they materially change the threat model. The host profile and screenshot transform an anonymous credential set into an attributable, priceable asset. A purchaser can determine the victim's employer, their likely role, whether the host is domain-joined, what security tooling is installed, and what applications were open. This is the difference between a credential and an access opportunity.

The aggregate output of a single execution is termed a stealer log. Its structure and downstream circulation are examined in what is stealer log monitoring.

Credential extraction

Understanding why stored credentials are extractable clarifies why the recommended controls are what they are.

Chromium on Windows encrypts stored passwords using a key that is itself protected by the Data Protection API (DPAPI), bound to the user account. Any process executing in that user's context can therefore request decryption. The encryption protects against offline access to a copied file; it does not protect against code running as the user. An infostealer, having been executed by the user, is running as the user.

This is not an implementation defect. It reflects a boundary decision: browser credential storage is designed to resist theft of the file, not compromise of the account.

In July 2024, Chrome introduced Application-Bound Encryption on Windows, binding the encryption key to the browser application via a privileged system service and raising the requirement for decryption beyond simple user-context execution. Stealer developers adapted within months, principally through abuse of the elevation service and through remote-debugging interfaces that request decrypted material from the browser process itself rather than attempting decryption directly.

The relevant conclusion for defenders is structural rather than tactical: hardening browser credential storage raises operator cost but has not removed the capability, and each mitigation has been met with an adaptation on a timescale of months. Browser-stored credentials should be assumed extractable by code running in the user's session.

Distribution and operator economics

Infostealers are distributed under a malware-as-a-service model. Development and operator functions are separated: authors maintain the builder, control panel and hosting, and sell subscription access; affiliates handle distribution.

This separation explains the observed volume. Distribution requires no development capability and no exploitation capability. The affiliate's problem is persuading users to execute a file, which is a marketing problem rather than a technical one — and the affiliate ecosystem has professionalized accordingly, with organized distribution teams operating under revenue-share arrangements.

Observed delivery vectors, approximately by volume:

Trojanized cracked software and game modifications. The dominant vector. The victim seeks a pirated application, encounters an antivirus warning during installation, and disables protection to proceed. The warning was correct; the social engineering consists of establishing an expectation that it would be a false positive.

Malicious search advertising. Paid placements above organic results for common software queries, resolving to convincing but attacker-controlled download pages.

Video platform and social distribution. Channels constructed to advertise free versions of commercial software, with links in descriptions.

Instruction-based execution ("fake CAPTCHA"). The victim is presented with a verification page directing them to open the Windows Run dialog and paste a supplied string, which invokes a scripting host to retrieve and execute the payload. This vector is notable for defeating controls oriented around file download and attachment inspection, because the user is the delivery mechanism.

Attachment-based phishing. Present but a declining share relative to the above.

The consistent property across vectors is that the victim initiates execution. Infostealer campaigns rarely depend on vulnerabilities, which means patch posture is largely irrelevant to exposure.

Evasion

Signature evasion is a marketed feature rather than an incidental property. Samples are repacked continuously — in some operations automatically, on a rolling basis — such that the binary presented to any given victim may be unique.

Additional techniques observed across families include execution-environment checks that suppress behaviour under analysis conditions, geofencing that halts execution in specified locales, in-memory execution to limit disk artifacts, and exfiltration over legitimate platforms and messaging APIs to blend with permitted egress traffic.

Empirically, the effect is substantial. In analysis conducted by the Alphatechs team across 881,387 compromised systems observed between March and May 2025, 786,041 hosts — approximately 89% — were running antivirus software at the time of compromise. A single family, Lumma Stealer, accounted for 242,091 infections within that dataset.

The finding should not be read as an argument against endpoint protection, which remains necessary. It is an argument against treating endpoint protection as sufficient for this specific threat class, and an argument for controls that assume compromise rather than prevent it.

From log to intrusion

Exfiltrated data enters a tiered market. Logs are distributed in bulk through messaging channels and marketplaces, frequently with free samples used to demonstrate quality and drive paid access.

A specialist function then operates on the aggregate: credentials are tested for validity, the resulting access is characterized, and verified access to organizations of interest is resold at a substantial premium over the bulk log price.

This intermediation is the mechanism by which an infection on an unmanaged personal device becomes an intrusion into a corporate environment. The initial compromise and the eventual breach are separated by weeks or months, by several changes of ownership, and by the boundary between personal and corporate infrastructure. Post-incident analysis frequently identifies the initial access vector as "valid credentials" without establishing the original source.

Organizational exposure

The defining difficulty is jurisdictional. A substantial proportion of infections occur on hosts the organization does not own, cannot inventory, and has no authority to inspect: personal laptops, family machines, contractor equipment.

The exposure nonetheless attaches to the organization. If corporate credentials were saved in a browser profile on that host, they are in the log. Endpoint telemetry records nothing because the endpoint is not enrolled. Network telemetry records nothing because no organizational network was involved. Access logs show a successful authentication, indistinguishable from a legitimate one.

The consequence is that internal instrumentation provides no signal. The earliest available indicator is external: the appearance of the credential in circulating log data.

Controls and their limits

Multi-factor authentication materially reduces the value of extracted passwords and should be considered baseline. Its limitation in this context is specific and important — it does not address exfiltrated session cookies, which represent state where the authentication challenge has already been satisfied.

Password managers reduce exposure when the vault remains locked and the master credential is not itself persisted in the browser. Neither condition is reliably met in practice.

Session revocation is the control most consistently omitted. Credential rotation does not invalidate extant sessions on most platforms; revocation is a distinct operation, typically located separately in administrative interfaces, and it should precede rotation rather than follow it — otherwise a window exists in which an attacker holding a valid session can observe the change and re-establish access.

Endpoint protection applies only to enrolled hosts, which excludes the majority of the infection population by construction.

Exposure monitoring addresses the visibility gap directly, and its value is a function of latency. Credentials revoked within hours of surfacing are largely inert. Credentials identified after months have typically been validated and, where valuable, already resold.

For the distinction between this class and keystroke-capturing malware, and the differing remediation each requires, see infostealer vs keylogger.