Inside the Information Stealer Ecosystem: From Compromise to Cash-Out

Inside the Information Stealer Ecosystem: From Compromise to Cash-Out

Speaker: Olivier Bilodeau

Conference: BSidesSF 2025 — April 26-27, 2025, San Francisco

YouTube: https://www.youtube.com/watch?v=zctTj66PA4g

Reading time: 9 minutes

TL;DR

Information stealer malware — a category that requires no admin rights, leaves no persistence, and can exfiltrate an entire computer's credentials in one shot — has become the backbone of the modern cybercrime economy. Olivier Bilodeau, drawing on a dataset of over 120 million deduplicated stealer logs, walked through the complete lifecycle from infection to cash-out, revealing that the threat goes far beyond passwords: TOTP secrets, password vault files, active cookies, and even Google "master cookies" are all harvested and sold through a sophisticated underground marketplace.

Introduction

Ask most security practitioners what information stealers do, and the answer is quick: they steal passwords. That answer is correct but dangerously incomplete. At BSidesSF 2025, Bilodeau — who spent years doing malware research at ESET and later threat intelligence at GoSecure before joining Flare — delivered a nearly 50-minute deep dive into an ecosystem that generates millions of infections per week and contributes to one in three data breaches, according to Verizon's DBIR. His argument was direct: the security industry talks too much about APTs and zero-days, and not enough about the industrialized credential theft pipeline that most corporate compromises actually flow through.

The talk was structured as a journey through the stealer lifecycle — infection vector, ecosystem mechanics, artifacts beyond passwords, defensive responses, and the landmark October 2024 takedown of the RedLine and Meta stealer operations — with Bilodeau offering community contributions including sample stealer logs and a credential-testing script for researchers who wanted to get hands-on.

▶ Watch: Introduction and Agenda (00:00)

How Information Stealers Work

The mechanics of a modern stealer infection are deliberately mundane. The malware executes in a single pass: it enumerates browser profiles across all installed browsers (leveraging the shared Chromium codebase to support every major browser from a single extraction routine), harvests saved credentials, browser history, autofill data, browser extensions, cookies, screenshots, and system information, packages everything into a ZIP archive, and exfiltrates it — increasingly over Telegram rather than a dedicated command-and-control domain, because Telegram is whitelisted in most corporate environments. Then it deletes itself and displays a fake error message to make the victim believe nothing happened.

Two properties make stealers particularly dangerous. First, administrative rights are not required — the browser credential database is accessible to the current user, and that is all the malware needs. Second, there is typically no persistence: the malware has no interest in lateral movement or prolonged access. It simply takes everything available in a single sweep, which means conventional persistence-based detection methods will miss it entirely.

▶ Watch: Stealer Malware Mechanics (04:00)

The log format itself is a key part of the ecosystem's value proposition. Unlike raw credential dumps, stealer logs pair each username and password with the URL where it was captured — providing the context that makes credential stuffing both efficient and accurate. The structured format (URL, username, password, application) is designed for automation; the downstream "checker" tools that cybercriminals use to validate stolen credentials consume this format directly.

The Distribution Ecosystem: Malware-as-a-Service at Scale

Stealer malware operates as a fully commercialized service. Operators advertise on Telegram with feature lists, change logs, and pricing tiers (typically $100–$300 per month for access to a stealer builder). Features are marketed like legitimate software products: supported browsers, file harvesting options, anti-detection obfuscation ("FUD" in cybercrime parlance means "fully undetected"), custom error messages, and file pumping to evade size-based AV scanning.

Distribution campaigns follow a documented playbook. An operator purchases access to a stealer, creates a video posing as a tutorial for cracked software (Cinema 4D, Midjourney, Roblox skins), uploads it to a compromised YouTube account, and links the malware in the description. The video may be promoted through TikTok or Google Ads. Victims who follow the tutorial and disable their antivirus at the prompt — a social engineering step baked into the malware's error messaging — are infected before they realize nothing worked.

▶ Watch: Distribution and Infection Campaigns (08:00)

Bilodeau's team currently observes approximately 1.5 million stealer logs per week in telemetry, with 120 million unique logs collected in total after deduplication. Roughly 15 million of those contain credentials associated with corporate domains. The logs are sold in bulk via subscription services on Telegram and dark web forums like Russian Market, with some operators claiming 150,000 to 200,000 new victims per month — numbers that Bilodeau's data suggests are broadly credible.

Beyond Passwords: What Else Gets Stolen

The section of the talk that generated the most attention was Bilodeau's analysis of artifacts in stealer logs beyond simple browser credentials.

TOTP secrets from browser extensions: Bilodeau demonstrated live that when a stealer targets the top-ranked "Authenticator" Chrome extension, it harvests the extension's LevelDB files. Because LevelDB does not encode strings, TOTP secrets stored in the database are trivially extractable. Bilodeau confirmed in a VM that using the stolen TOTP secret in an online generator produces the same time-based code as the victim's authenticator — effectively defeating software-based MFA entirely without requiring any interaction with the target after the initial infection. His recommendation: corporate environments should block browser-based TOTP extensions at the policy level.

▶ Watch: MFA Bypass via Browser Extensions (22:01)

Password vault files: Stealers harvest KeePass .kdb and .kdbx files. Using keepass2john from the John the Ripper suite, an attacker can extract the key material in a format suitable for offline cracking with Hashcat. The risk compounds if the victim has reused their master password or used a derivation of a password already present in the browser credential store — a scenario Bilodeau's team has successfully exploited in controlled workshop environments.

Cloud password manager exposure (Bitwarden analysis): Stealers also target cloud-based password manager extensions. Bilodeau analyzed Bitwarden's extension artifacts and found that while sensitive fields (URLs, entry names) are encrypted using best-in-class AES with HMAC, the key question of whether the master password can decrypt those fields from the stolen files remains open research. His current finding is that Bitwarden's encryption holds up well against the artifacts typically captured.

Google "master cookies": Bilodeau described a cybercrime technique where stolen cookies from the browser's SQLite store can be combined with a so-called "master cookie" to regenerate valid session cookies for Google properties. The technique is documented in cybercrime tooling derived from Chromium's open-source code and does not require leaked internal secrets. Google is aware of the technique and actively monitors for suspicious cookie reuse, but it remains a vector that defenders should be aware of.

Cookies broadly: Session cookies harvested from the SQLite databases in browser profiles can be fed directly into checker tools — automated validators like BLTools that test whether the stolen cookies still produce valid sessions on platforms like YouTube, Twitch, Netflix, or Spotify. These tools consume the stealer log format natively and are proxy-aware.

The RedLine / Meta Takedown and Its Aftermath

In October 2024, an Europol-led operation — dubbed Operation Magnus — seized the infrastructure behind RedLine and Meta, two of the most prolific stealer operations in the world. Bilodeau's team had been collaborating with ESET for approximately two years leading up to the takedown. The telemetry showed the impact clearly: a sharp drop in stealer log volume following the seizure, with a small subsequent bump from operators reselling previously collected logs.

The most surprising finding from the forensic analysis: RedLine and Meta, which competed publicly in cybercrime forums and had distinct branding, were operated by the same entity. They shared TLS certificates including private keys and had near-identical feature sets and UIs. The "competition" was a deliberate market fragmentation strategy to capture a larger share of the infostealer market.

▶ Watch: RedLine Takedown and Operation Magnus (40:02)

Law enforcement announced the takedown with a satirical video in the style of a software update notification, listing the "features" of the operation: full access to all RedLine and Meta servers, usernames, passwords, IP addresses, and source code. The final line: "VIP status for all RedLine and Meta users — where VIP means Very Important to the Police." The void left by the takedown has since been filled by Raccoon, Vidar, and most prominently Lumma C2.

Defensive Guidance

Bilodeau organized his defensive recommendations around understanding, education, protection, and remediation:

• Removing admin rights is not sufficient protection — stealers operate at user level and do not need elevated privileges to harvest browser credentials, cookies, or extension data.
• Staff should be explicitly told never to disable antivirus, even when prompted by an installation process. This sounds obvious but is rarely stated as a policy.
• Work computers should not be shared with family members, particularly those who might download cracked games or free software.
• Organizations should test their own credentials against stealer log data available on dark web forums — automatically and regularly — while being careful about rate limiting and account lockout.
• Chrome's application-bound encryption (introduced September 2024) improves the telemetry available for detection even though it was bypassed within weeks; defenders should treat the bypass techniques (headless Chrome remote debugging, COM impersonation of Chrome, registry key manipulation) as new detection signals rather than evidence the defense failed.

Notable Quotes

"Administrative rights are not required. It's really like stealing everything, packaging it up in a ZIP file, uploading it to a Telegram channel, and then deleting itself." — ▶ 04:00

"One breach out of three has stolen credentials related to the attack or in the attack path." — ▶ 44:03

"VIP means Very Important to the Police." — Operation Magnus video, ▶ 40:02

Key Takeaways

• Information stealers are the primary on-ramp for corporate breaches, feeding initial access brokers and direct credential-stuffing attacks with structured, context-rich credential data at scale.
• The threat extends far beyond passwords: TOTP secrets, KeePass vault files, active session cookies, and cloud password manager artifacts are all routinely harvested — and in some cases, these completely bypass MFA.
• The ecosystem is fully commercialized: malware-as-a-service builders, bulk log marketplaces, and checker automation tools reduce the barrier to entry for cybercriminals to near zero.
• The RedLine/Meta takedown demonstrated that major stealer operations can be disrupted, but the market adapts quickly — Lumma C2 and others have filled the void since October 2024.
• Defenders should engage with real stealer log samples to understand what an attacker learns from a single infected endpoint, since the scope of exposure is typically far larger than most security teams assume.