Hackers Dropping Mid-Heist Selfies

Hackers Dropping Mid-Heist Selfies: Using LLMs to Analyze Info-Stealer Screenshots at Scale

Speakers: Research team including Estelle (analyst), and a second presenter (names partially given during talk); Hudson Rock / independent researchers

Conference: Black Hat USA 2025 — August 6-7, 2025, Mandalay Bay, Las Vegas

YouTube: https://www.youtube.com/watch?v=WQFIfORignI

Reading Time: ~10 minutes

Type: Briefing

TL;DR

Researchers built a two-layer LLM pipeline to analyze over 15 million screenshots automatically captured by information-stealer malware at the moment of infection. By applying analyst intuition as structured prompt engineering, the system extracts infection vectors, live indicators of compromise (IoCs), and campaign themes at scale — revealing two active campaigns (Midjourney and "Blitz Java") that each accounted for five to six percent of all infections in the dataset, and exposing a systematic playbook threat actors use to lure and infect victims.

Introduction

Information-stealer malware has become one of the most prolific threat categories in the current cybercrime ecosystem. Families like RedLine, Lumma C2, and dozens of others execute without administrative privileges, harvest credentials, browser data, crypto wallets, clipboard contents, password manager files, and system information, then exfiltrate everything to Telegram-based C2 infrastructure. The resulting "stealer logs" — bundles of victim data — are resold in cybercrime marketplaces for further exploitation.

What makes this threat unique from a research perspective is that many stealer families include a screenshot feature: at the moment the malware detonates, it photographs the victim's screen. Originally designed to help operators verify sandbox avoidance and gain situational context, this feature inadvertently creates a rich forensic artifact. The screen captures show exactly what the victim was looking at when they were infected — typically the download page, video, or installer that was the lure. Researchers obtained over 15 million such screenshots across eleven malware families by monitoring Telegram channels where these logs are distributed. The challenge: analyzing them manually is impossible at that scale. The solution: an LLM pipeline designed to think like an analyst.

Why Screenshots Matter — The Mid-Heist Selfie

▶ Watch: What Info-Stealer Screenshots Reveal (02:00)

A stealer screenshot is essentially a crime-scene selfie taken by the criminal. A typical example shows a YouTube page discussing "undetected" Fortnite cheats with a download link in the description, or a file manager showing recently downloaded archives with suspicious names, or a browser window pointing at a well-crafted fake website mimicking a legitimate software vendor. Each screenshot contains enough information to reconstruct the full infection story: what lured the victim, where they downloaded the payload, what platform they were using, and whether the download link may still be live and distributing malware.

With 15 million screenshots in hand and eleven malware families represented, the team needed automation. They turned to large language models — but quickly learned that a naive single-prompt approach does not work.

Designing a Two-Layer LLM Pipeline

▶ Watch: LLM Pipeline Architecture (04:00)

The critical insight driving the pipeline design is that human analysts don't process screenshots in a single cognitive step. When examining a screenshot, an analyst first orients: identifies the type of content, reads the scene. Only after that orientation do they apply domain knowledge to identify specific suspicious indicators — a download link structure that matches a known malware distribution pattern, or a YouTube video with "undetected" in the title. Asking a single LLM layer to do both tasks simultaneously collapses two distinct cognitive steps into one instruction, and the model fails unpredictably.

The solution was to split the analysis:

Layer 1 — Visual Description: The screenshot is passed to the first LLM with a structured prompt requesting four elements:

• Scene description (what is happening overall)
• File explorer and installer information (filenames, software being installed)
• Links visible in the screenshot
• Anything that appears suspicious (with explicit instructions about what counts as suspicious: file-sharing links, YouTube videos mentioning cracks, archive download prompts with AV-disable instructions)

A fifth element — browser tab identification — was added initially but dropped after assessment showed it performed reliably in only 30% of cases (and sometimes fabricated bookmarks instead of tabs). Removing it did not degrade overall pipeline accuracy.

Layer 2 — IoC and Campaign Classification: The formatted text output from Layer 1 is fed to a second LLM that identifies the infection vector (e.g., "file-sharing platform") and the campaign theme (e.g., "Microsoft Office cracked software"). The output is structured JSON including all extracted URLs, the malware family name, and classification labels.

Assessment of Layer 1 on 1,000 screenshots showed strong performance: 96% accuracy on scene description, 100% on file explorer detection, 100% on link extraction, and 95% on suspicious element identification. Processing cost runs approximately $0.003 per screenshot across both LLM layers.

IoC Checking: Separating Live Threats from Dead Links

▶ Watch: IoC Checking Pipeline (14:01)

The raw IoC feed from the LLM pipeline initially contained many dead links — URLs that were no longer distributing malware. A useful threat intelligence feed requires live IoCs, so the team built a checking layer with category-specific heuristics:

File-sharing platforms (Mega, MediaFire, etc.): These return clear HTTP error codes and error messages when files are removed. Dead links are labeled as such but retained for incident response purposes. Live links that require a decryption key are still classified as live — the key is typically present in the screenshot's YouTube video description, and the social engineering chain remains active.

YouTube: Clear "video unavailable" messages allow easy dead/live classification. For live videos, the pipeline additionally checks whether the video description still contains a download link; some threat actors edit descriptions to remove the link (presumably to evade Google detection) while leaving the video up, in which case the result is classified as a "theme" rather than a live IoC.

Other URLs: The pipeline hunts for download buttons and other indicators of active distribution.

This IoC pipeline enables real-time threat intelligence: live URLs can be blocked at corporate proxies, uploaded to VirusTotal for antivirus coverage, or used to track campaign evolution over time.

The Info-Stealer Playbook: Lures and Distribution

▶ Watch: Campaigns and Threat Actor Tactics (20:06)

Running the full pipeline on tens of thousands of screenshots revealed a consistent playbook. Threat actors rely on two categories of lure theme and two primary distribution strategies.

Lure Theme 1 — Cracked Software: Mainstream paid software is the top target: Microsoft Office, Vegas Pro, Midjourney, Filmora. These products have large user bases and meaningful licensing costs, creating genuine financial pressure that threat actors exploit. A significant number of victims are IT professionals who believe their experience protects them — it does not.

Lure Theme 2 — Gaming Cheats and Mods: Fortnite, Valorant, and Minecraft cheats target a younger demographic with limited financial resources but strong desire for in-game items, skins, and abilities. These games are accessible entry points into gaming, suitable for players of all ages, and frequently introduce paid cosmetics — creating the same psychological dynamic as cracked software.

Distribution 1 — YouTube: Videos titled with phrases like "100% working," "undetected," "safe," or "free" serve as the first step in the infection chain. The video body contains a download link (often to Mega), a password for the archive, and installation instructions that include disabling antivirus. The instructions frame AV disabling as necessary for "false positives" from the "legitimate" software — conditioning the victim to accept this step before they encounter the prompt.

Distribution 2 — Google Ads: Threat actors purchase Google Ads targeting searches for legitimate software names, placing malicious copies of vendor websites at the top of search results. This is highly effective because users expect search-result-promoted links to be trustworthy. Ads can be geographically and temporally targeted, enabling precision campaigns.

Case Studies: Midjourney and Blitz Java

▶ Watch: Campaign Case Studies (26:06)

Two campaigns dominated the dataset, each accounting for more than five percent of all infections observed.

Midjourney Campaign: The infection chain begins with a Google search for Midjourney — the popular AI image generator that has no free tier. A sponsored ad appears above the legitimate site. Clicking it leads to a high-quality replica of the Midjourney website that includes a preemptive disclaimer: "It is possible that the computer security system may falsely trigger." This single sentence is a psychological primer: it tells the victim that any AV alert is expected and normal, eliminating the most reliable warning signal available to them. The victim downloads an executable, is prompted to disable AV when it "doesn't work," and discovers only afterward — when searching to troubleshoot the non-functional application — that they have been infected.

Blitz Java Campaign: Screenshots initially showed a standard Java installer, leading the team to wonder briefly whether the official Java download infrastructure had been compromised. It had not — the attack used the same Google Ads technique, with a nearly pixel-perfect replica of the java.com download page. Side-by-side comparison reveals missing developer resource links, subtle spacing differences, a different button font, a missing hyperlink, and a different file size — none of which a user examining a single page would notice. The campaign ran for 19 hours, spanning a weekend (February 11–12), a deliberate timing choice to maximize victims during leisure hours and reduce the response speed of security teams.

Strengths, Limits, and Future Work

▶ Watch: Pipeline Assessment and Future Directions (32:07)

A key strength of the approach is that it is agnostic to malware code changes. Traditional signature-based detection requires continuous adaptation as operators repack payloads. The screenshot pipeline analyzes the distribution infrastructure and user experience, which changes far more slowly. It works across all malware families that include a screenshot feature and remains effective even when a new packer is introduced.

The approach's weakness is equally clear: if operators remove the screenshot feature — which this research might motivate — the pipeline loses its input. A secondary limitation is screenshot quality; some captures show a generic desktop with no actionable information about the infection vector.

Future work, described as already in working-state and planned for submission to Black Hat Europe, extends the same philosophy to all stealer log artifacts: installed software lists, process trees, browser history, and system information. The project, internally called "Sharelog" or "Sherlock," would allow an LLM to synthesize all artifact types into a unified infection narrative answering the question "what happened and how were they compromised?"

Notable Quotes

"When we look at it, for us, this is more like they are taking a selfie of a crime scene. There's so much information we can extract from that screenshot."

— Presenter ▶ 02:00

"An LLM can't just figure it out. You have to translate your analyst intuition into instruction if you want the LLM to carry out the task properly."

— Estelle ▶ 06:00

"The gaming lesson here is: if it's free and shady, you are likely the victim — and dare I say, even the product."

— Presenter ▶ 22:06

"Threat actors still rely on simple psychological tactics because they simply still work so well. Why would you pain yourself by doing a technical exploit when all you need is just manipulate people?"

— Presenter ▶ 30:07

Key Takeaways

• Info-stealer screenshots are a rich, underutilized threat intelligence source. Fifteen million screenshots across eleven malware families provide near-complete visibility into infection vectors and distribution infrastructure.
• LLM pipeline design requires translating analyst intuition into explicit instructions. A single-step prompt fails; decomposing the task into a visual description layer and an interpretation layer produces 95–100% accuracy across key extraction categories.
• The threat actor playbook is consistent and psychologically sophisticated. Cracked software and gaming cheats exploit financial motivation; AV-disable instructions are embedded in the lure content before the victim reaches the executable; Google Ads and YouTube create a veneer of legitimacy.
• Live IoC extraction at $0.003 per screenshot is operationally viable. At scale, this creates a near-real-time threat intelligence feed that can drive proxy blocks, VirusTotal submissions, and campaign awareness before malware gains broader AV coverage.
• Despite enforcement action against RedLine and Lumma C2, info-stealer activity is increasing. Lumma collection rates post-takedown exceeded pre-takedown levels at the time of the talk, underscoring that dismantling infrastructure does not eliminate the underlying criminal economy.

No slides PDF was listed for this briefing.