Infostealer Ecosystem Sustains Credential Theft Despite Most Takedowns

Infostealer malware continues to expose enterprise credentials, browser sessions, API keys and developer artifacts at scale, despite major law-enforcement disruption efforts. Analysis of roughly 44 million compromised-host logs collected from June 2024 through June 2026 found that most takedowns displaced operators to alternative stealer families rather than reducing the overall market. The coordinated action against LummaC2 was the exception: its sustained decline was linked to simultaneous disruption of infrastructure, distribution, monetization and criminal-market trust. Earlier Lumma campaigns used fake CAPTCHA pages to induce PowerShell execution and deploy the stealer, illustrating the social-engineering delivery methods still used to seed credential theft.

The expanding malware-as-a-service market lowers the barrier for new operators. A recently analyzed Python-based builder can create customized Windows stealers that collect Chromium and Firefox data, Wi-Fi credentials, Discord tokens, Roblox cookies, and host details before sending results to attacker-controlled Discord or Telegram webhooks; it also supports anti-analysis checks and Run-key or scheduled-task persistence. Research covering 170,298 victims found stolen credentials affecting government, military, law-enforcement, financial, remote-access and university services, with credential reuse and overlap with phishing and ransomware victims increasing repeat-compromise risk. For enterprises, compromised developer endpoints are particularly consequential because stolen cloud CLI caches, browser tokens, CI/CD secrets, service-account keys and AI-platform sessions can enable access to AWS, Azure, GCP, source-code repositories and AI tools while bypassing MFA through hijacked authenticated sessions.