Infostealer Malware Resurgence Targeting Browser Credentials, Crypto Wallets, and Cloud-Synced Data

Threat researchers reported continued growth in the infostealer ecosystem, with new families emphasizing theft of browser credentials, session cookies, and cryptocurrency wallet data. Zscaler ThreatLabz detailed Marco Stealer, first observed in June 2025, which profiles infected hosts (e.g., OS version, hardware ID, IP/geolocation) and targets browser data plus cryptocurrency wallet information from browser extensions; it also searches for sensitive files in local and cloud-synced locations, including folders associated with Dropbox and Google Drive, and uses anti-analysis measures such as runtime string decryption.

Separately, Cyfirma described LTX Stealer, a Windows-focused infostealer built around a bundled Node.js runtime and delivered via an Inno Setup installer (Negro.exe) that drops an unusually large (~271 MB) payload—reportedly to evade scanning heuristics. LTX Stealer targets Chromium-based browsers by extracting keys from Local State to decrypt saved passwords and cookies, collects screenshots, and stages data for exfiltration while using services such as Supabase (authentication) and Cloudflare (infrastructure masking). Flare’s research contextualized these developments as part of an “infostealer arms race,” observing multiple variants being marketed/updated across dark web forums and highlighting the downstream impact: analysis of 18.7M infostealer logs (2025) found enterprise SSO/IdP credentials in more than 10% of infections, and Verizon DBIR data cited by Flare linked infostealer credential exposure to a significant share of ransomware victimization; Flare also noted stealer developers rapidly adapting to Chrome’s evolving credential protections (e.g., post-v127 application-bound encryption and newer Chrome releases).