Loading malware…
RedLine Stealer is a Windows information-stealing malware family that emerged in March 2020 and is distributed commercially through a malware-as-a-service model. It steals browser-saved credentials, session cookies and tokens, autocomplete data, payment card information, instant messages, and cryptocurrency wallet information. It also collects operating system and hardware details, running-process information, language settings, and FTP client information. Additional functionality includes file upload and download and command execution.
RedLine has been distributed through phishing, malicious advertisements, cracked software, weaponized Microsoft Office documents, deceptive software downloads, and fake Windows upgrade tools. It has also appeared among payloads delivered by ClickFix campaigns using counterfeit Windows update alerts. Documented evasion behavior includes injecting its payload into the legitimate .NET Framework Visual Basic compiler process. RedLine has also been associated with Windows UAC bypass through DiskCleanup scheduled-task hijacking.
Cybercriminals trade RedLine-generated logs through underground forums and marketplaces, enabling credential abuse, authenticated-session hijacking, and subsequent corporate intrusions. Lapsus$ has used RedLine to obtain passwords and session tokens. Both personal and employee computers are affected, and business credentials stored on personal devices can expose organizational systems. RedLine-derived credentials have also preceded ransomware intrusions, although subsequent ransomware activity is separate from the stealer's own functionality. International law enforcement disrupted infrastructure supporting RedLine and Meta infostealers in late October 2024 and announced charges against a RedLine developer and administrator.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
CVE-2024-1709 (CWE-288) — Authentication Bypass Using Alternate Path or Channel. Base CVSS score of 10, indicating “Critical”.
CVE-2024-1708 (CWE-22) — Improper Limitation of a Pathname to a Restricted Directory (“Path Traversal”). Base CVSS score of 8.4, still considered “High Priority”.
Microsoft created a security patch for Windows systems to fix the vulnerability, giving it the CVE identifier CVE-2024-43451. The security patch was published on November 12th, 2024. | The other files detected exploiting the new vulnerability followed a similar attack scenario that ended with the installation of Redline Stealer malware.
The embedded file with a randomized file name exploits a particular vulnerability —CVE-2017-11882—to execute malicious code to deliver and execute malware on a victim’s device. | Redline (also known as Redline Stealer) is a commercial malware family designed to collect sensitive information from infected devices, such as saved credentials, autocomplete data, credit card information, and more.
18 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
“Lapsus$ Group” has used “RedLine” to obtain passwords and session tokens.
The threat actor, tracked by Mandiant as UNC5587, used infostealer malware such as RedLine, Lumma, and Vidar to harvest credentials from infected employee devices.
2020 (or earlier): The Infection The campaign operator gets infected by RedLine Stealer. Admin credentials are exfiltrated to the Dark Web.
2020 (or earlier): The Infection The campaign operator gets infected by RedLine Stealer. Admin credentials are exfiltrated to the Dark Web.
In many cases, ZingoStealer also delivers additional malware such as RedLine Stealer and the XMRig cryptocurrency mining malware to victims.
Batloader has been observed to drop several malware payloads, such as Ursnif, Vidar, Bumbleloader, RedLine Stealer, ZLoader, Cobalt Strike, and SmokeLoader.
37 distinct techniques documented for this family, organized by ATT&CK tactic.
1,534 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Cited as credential-stealing malware used in earlier Snowflake customer breaches. The article describes these infostealers as collecting browser cookies, saved passwords, and CLI configurations. RedLine is not confirmed as involved in the ASOS incident.
Cited as an example of an infostealer that can harvest browser vaults, session cookies, Discord tokens, and saved SSH/FTP credentials and send them to attacker-controlled infrastructure. The content does not establish that RedLine was used in this breach.
An information stealer described as extracting browser cookies, authentication tokens and session IDs. The article discusses session theft as a hypothetical route to Microsoft's X account compromise; it does not establish that RedLine was involved.
Infostealer cité parmi les principales familles impliquées dans le vol de credentials cloud, de code et d'outils d'IA.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.