Infostealers

Infostealers

Speakers: Will Frame, Pentester, Bastion Security Group

Conference: CHCon

YouTube: https://www.youtube.com/watch?v=gmEykFnb9i0

Overview

In this insightful talk from CHCon, Will Frame, a pentester at Bastion Security Group, unravels the escalating threat of infostealers, a rapidly evolving category of malware that has become a primary driver of business compromise. Frame, also the creator of the free info monitoring solution "reseller," provides a comprehensive examination of what infostealers are, how they operate, their profound impact on organizations and individuals, and crucial defense strategies. Drawing parallels to his childhood experience with "web browser view," Frame highlights the core functionality of infostealers: automatically searching for and exfiltrating sensitive data from a compromised machine to a criminal-controlled server.

Unlike traditional phishing attacks that target single credentials or typical malware that often seeks persistence, infostealers are characterized by their rapid, non-persistent "hit-and-run" nature. They are designed to execute quickly, scrape as much data as possible, and then uninstall themselves to evade detection by Endpoint Detection and Response (EDR) solutions. This unique modus operandi makes them particularly insidious, as a machine could be compromised, data exfiltrated, and the malware gone before an organization even realizes an attack occurred.

Frame's talk is a critical wake-up call for both individuals and businesses, emphasizing that infostealers are no longer a fringe threat but a mainstream attack vector. The presentation delves into real-world breaches, technical mechanics using the notorious Redline stealer as an example, and practical, actionable advice for bolstering defenses. Given their increasing prevalence and sophisticated methods, understanding and mitigating infostealer threats is paramount for maintaining digital security in today's landscape.

Background

▶ Watch: Introduction: What are info stealers? (0:00)

The concept of software designed to steal information from a computer system is not new, with its roots tracing back to the Zeus Trojan in 2007. However, the modern infostealer landscape has evolved dramatically, characterized by increased sophistication, accessibility, and a broader scope of data theft. Today, popular variants like Luma, Redline, and Raccoon Stealer dominate the scene, often distributed through a Malware-as-a-Service (MaaS) model that emerged around 2019. This model significantly lowers the barrier to entry for aspiring cybercriminals, allowing individuals with minimal technical expertise to purchase and deploy powerful infostealers.

Infostealers are typically installed through various vectors, including infected or pirated software, malicious advertising (malvertising), and phishing emails. Frame elaborates on malvertising, describing scenarios where pop-ups on seemingly legitimate web pages prompt users to run a command that has already been copied to their clipboard. These commands are cleverly crafted to download and execute an infostealer, often appending benign-looking text to appear more trustworthy. This method exploits user trust and a lack of technical understanding.

A crucial distinction Frame makes is between infostealers and other common cyber threats. Standard phishing attacks usually focus on tricking a user into surrendering a single set of credentials for a specific service. In contrast, infostealers aim to harvest all sensitive data available on a machine, including credentials for numerous websites, autofill data, browser cookies, and system information. Furthermore, unlike much traditional malware that strives for persistence within a system for long-term control, infostealers are designed for speed and stealth. They execute rapidly, collect their payload, and often uninstall themselves immediately after exfiltration. This "hit-and-run" characteristic makes detection and forensic analysis significantly more challenging, as the active threat may be gone by the time a compromise is suspected, leaving behind only subtle artifacts. The shift towards this non-persistent, automated approach highlights a strategic evolution in cybercrime, prioritizing rapid data acquisition over sustained system access.

Key Findings

▶ Watch: How Redline info stealer operates via MaaS (5:45)

The talk underscored the pervasive and severe impact of infostealers, presenting alarming statistics and real-world breach examples that illustrate their growing threat. A study conducted earlier this year revealed that a staggering 64% of medium to large businesses had experienced at least one infostealer infection across their organization since 2019. This high prevalence translates directly into significant business compromises and data breaches.

Frame cited several high-profile incidents directly linked to infostealers:

• Hot Topics Database Breach (October 2024): One month after an employee with access to their Snowflake instance was infected with an infostealer, Hot Topics suffered a breach affecting 56 million accounts. This sensitive data included full names, email addresses, partial credit card details, purchase history, and physical addresses of customers.
• Law Enforcement Request System Compromises: A user on BreachForums was found selling access to law enforcement request systems for major platforms like LinkedIn, Binance, Discord, Stripe, Coinbase, Facebook, and Google. These systems allow for "emergency data requests," essentially subpoenas for user data. A cybersecurity company identified that this access was most likely obtained through infostealer logs, with over 50 sets of credentials for Google's law enforcement request system alone being discovered in Telegram group chats.
• Ticketmaster Breach: An infostealer infection on a Ticketmaster employee's device led to the hacking group ShinyHunters discovering and listing 560 million customer details for sale on BreachForums. The compromised data included ticket sales, partial credit card details, full names, addresses, phone numbers, and email addresses.

Several common problems emerged from these breaches:

• Lack of Multi-Factor Authentication (MFA): Many compromised accounts lacked MFA, which would have provided a crucial additional layer of security, making it harder for attackers to leverage stolen credentials.
• Personal Device Vulnerability: Infostealers frequently infect employees' personal devices. If an employee logs into sensitive corporate accounts on a personal device that lacks robust EDR software like Crowdstrike Falcon, those credentials can be easily exfiltrated, serving as a gateway to corporate networks. Frame stressed that personal devices are now part of a business's security perimeter.
• Delayed Detection: In all cited cases, the compromised credentials were available to criminals for more than 30 days before the breaches surfaced. While access might have occurred earlier, earlier detection would have allowed businesses to mitigate damage by deactivating accounts, notifying users, or forcing password resets.

Beyond enterprise breaches, Frame also presented findings from his own password analysis using a sample of 10 billion infostealer log records from his "reseller.com" project. This analysis identified 12,000 unique New Zealand domains with at least one infostealer infection and over 1 million records on New Zealand email domains (excluding generic domains like Gmail.com). The most alarming statistic from this analysis was the prevalence of password reuse: over three-quarters of New Zealanders reuse passwords across platforms, significantly higher than the typical 60-65% observed in studies of the United States population, highlighting a critical vulnerability.

Technical Deep Dive

▶ Watch: Alarming password reuse statistics and risks (8:20)

To illustrate the inner workings of infostealers, Will Frame used Redline as a prime example, one of the most prolific variants available today. Redline operates under a Malware-as-a-Service (MaaS) model, democratizing cybercrime by offering licenses ranging from $150 per month to $900 for a lifetime license. This low entry barrier means that individuals with limited technical proficiency can acquire and deploy sophisticated infostealers. The Redline backend provides a criminal with the ability to build an infostealer binary, which can then be embedded in other software or directly distributed through phishing or malvertising campaigns.

A key feature of Redline, and many modern infostealers, is its automatic Telegram integration. This allows all scraped information from compromised machines to be exfiltrated and sent directly to a designated Telegram group chat. This not only facilitates rapid data collection but also enables easy distribution and collaboration among criminal groups. Frame displayed screenshots of these Telegram channels, showing how logs are distributed to other criminals or even researchers.

The data collected by infostealers is extensive and goes far beyond basic login credentials. A typical infostealer log folder contains:

• All saved credentials: For virtually every website and application saved on the machine.
• Autofill data: This includes names, addresses, credit card numbers, and other personal information stored in browser autofill profiles.
• Cookies: This is a critical component. Even if an account is protected by Multi-Factor Authentication (MFA), stolen session tokens (cookies) can often be used to bypass MFA, allowing attackers to hijack active user sessions without needing the password or the second factor.
• "Brute" file: This file often contains a list of all passwords previously used by the user on their machine. This can be invaluable for dictionary brute-force attacks against other accounts, especially given the widespread problem of password reuse.
• Software processes and system information: Details about running applications, operating system versions, and hardware specifications. This information can be used for further exploitation or to tailor subsequent attacks.
• Clipboard content: The current content of the user's clipboard is often captured. This can reveal commands that were copied and executed, sensitive data, or, as Frame noted, even direct download links to the infected software itself.

Frame's personal research using data from his "reseller.com" project provided further insights into the scale of the problem. His analysis of 10 billion infostealer log records identified 12,000 unique New Zealand domains that had suffered at least one infection, alongside over 1 million records associated with New Zealand email domains. This data underscores the global reach and localized impact of these threats.

The stolen infostealer data is a commodity in underground markets. Frame showed screenshots from various Telegram channels where this data is openly sold. Prices typically range from $60 to $200 USD per month for access to databases of credentials from compromised organizations. These groups often offer free samples to demonstrate the quality and breadth of their data, further professionalizing the cybercrime ecosystem. The existence of such marketplaces highlights the economic incentives driving the development and distribution of infostealers.

Demo / Proof of Concept

▶ Watch: EDR limitations: The importance of memory scanning (10:10)

While Will Frame did not conduct a live, interactive demonstration or proof of concept in the traditional sense, the presentation effectively served a similar purpose through compelling visual evidence and detailed analysis. He provided several crucial screenshots directly from the operational tools and environments used by infostealer operators and victims.

Specifically, Frame showed:

• A screenshot of the Redline backend, illustrating the Malware-as-a-Service (MaaS) interface that criminals use to build and manage their infostealer campaigns. This visual gave the audience a direct look into the ease of use and features available to attackers.
• Images of Telegram channels where infostealer logs are automatically exfiltrated and distributed. These examples highlighted the real-time nature of data theft and the collaborative aspect of cybercriminal operations.
• A detailed view of a compromised data folder, showing how infostealers organize the vast amount of stolen information, including credentials, cookies, autofill data, and system information. This provided concrete evidence of the scope and variety of data stolen.
• Screenshots from different Telegram channels actively selling stolen infostealer data, complete with pricing and free sample offers. These visuals underscored the commercialization of infostealer operations and the existence of a thriving underground market for compromised data.

Through these visual aids and his in-depth explanation, Frame effectively demonstrated how infostealers work, what data they collect, and how that data is then monetized, providing a clear and comprehensive understanding without the need for a live execution.

Defensive Implications

▶ Watch: Key protection advice for individuals and businesses (11:30)

Defending against infostealers requires a multi-layered approach that addresses both technical vulnerabilities and human factors. Will Frame outlined several critical strategies for individuals and businesses:

1. Infostealer Monitoring Solutions: These services aim to acquire stolen data from criminal sources and provide it back to businesses, enabling earlier detection of compromises. However, Frame highlights a significant ethical dilemma: these solutions often purchase data directly from criminals, inadvertently funding the very cybercrime they seek to combat. Businesses must weigh the benefits of early detection against the potential for indirectly supporting criminal enterprises.

1. Enhanced EDR (Endpoint Detection and Response):

• Memory Scanning is Critical: Infostealers often run web browsers in debug mode and perform credential extraction directly from memory to evade disk-based detection. Frame emphasized that if an EDR solution is not performing memory scanning, it will likely miss infostealers entirely. Only about half of EDR software currently includes robust memory scanning capabilities.
• Small Detection Window: The non-persistent nature of infostealers means the window for EDR to detect and kill the process before data exfiltration is extremely narrow—often mere milliseconds.
• Artifact Analysis: Even if the infostealer successfully exfiltrates data and uninstalls, it can leave behind artifacts. These include logs showing credential store file access, browser debug mode events, and non-browser processes interacting with browsers. While useful for forensic analysis, discovering these artifacts often means it's already too late.

1. Preventing C2 Communication:

• Predictive DNS and Domain Registration Analysis: Utilizing machine learning, statistical modeling, and real-time DNS data can help flag and block suspicious domains used for Command and Control (C2) communication by infostealers.
• CTI (Cyber Threat Intelligence) Solutions: Leveraging threat intelligence feeds can provide proactive information on known infostealer C2 infrastructure.
• Network Behavioral Detection: Monitoring suspicious HTTP or DNS traffic patterns can identify attempts by infostealers to communicate with their C2 servers.

1. Individual User Best Practices:

• No Password Reuse: This was a major takeaway, especially given the high rates of reuse observed. Unique, strong passwords for every account significantly limit the damage from a single compromised credential.
• Implement MFA: Multi-Factor Authentication should be enabled wherever possible. While infostealers can sometimes bypass MFA via stolen session cookies, it still presents a significant hurdle for attackers and protects against many common credential theft scenarios.
• Exercise Extreme Caution with Downloads and Commands: Never run commands or install software from untrusted sources, even if prompted by a CAPTCHA or seemingly legitimate pop-up. Malvertising often tricks users into executing malicious commands directly.
• Avoid Corporate Logins on Personal Devices: Employees should refrain from logging into sensitive corporate accounts on personal devices, especially if those devices lack the same level of security (e.g., EDR, strict patching) as corporate endpoints. Frame stressed that personal devices are now effectively part of the corporate security perimeter.

1. Business-Specific Defenses:

• Treat Personal Devices as Part of the Perimeter: Businesses must acknowledge and plan for the risk posed by employees' personal devices accessing corporate resources. This may involve implementing BYOD (Bring Your Own Device) policies with strict security requirements or providing corporate devices for sensitive work.
• Implement Memory Scanning EDR and/or Infostealer Monitoring: Investing in EDR solutions capable of memory scanning is crucial. Complementing this with infostealer monitoring solutions (with an awareness of the ethical implications) can provide an early warning system.
• Application Allow Listing: Where feasible, implement application allow listing to prevent unauthorized or malicious software from running on corporate endpoints.
• Disable PowerShell: Restricting or disabling PowerShell for employees where it's not strictly necessary can significantly reduce a common vector for infostealer execution.

In conclusion, combating infostealers requires a proactive, multi-faceted strategy that combines advanced technical controls like memory-scanning EDR and C2 prevention with robust user education and strict security policies, acknowledging the expanded security perimeter that now includes personal devices.

Key Takeaways

• Infostealers are a primary cause of business compromise: They are a rapidly growing threat, with 64% of medium to large businesses experiencing at least one infection since 2019, leading to major data breaches.
• Unique Attack Vector: Unlike traditional malware, infostealers are non-persistent, automated "hit-and-run" threats designed for rapid data exfiltration, making detection challenging and the window for mitigation extremely small.
• MFA Bypass and Comprehensive Data Theft: Infostealers steal not just passwords but also critical session cookies, which can bypass Multi-Factor Authentication (MFA), along with autofill data, system info, and clipboard contents.
• Personal Devices are Corporate Risk: Employee personal devices, often lacking corporate-grade Endpoint Detection and Response (EDR), are significant vectors for infostealer infections that can lead directly to corporate data breaches.
• Memory-Scanning EDR is Essential: Traditional EDR solutions often miss infostealers that operate in memory. Businesses must implement EDR with robust memory scanning capabilities to effectively detect and prevent these threats.
• User Education and Basic Hygiene are Paramount: Strong password hygiene (no reuse), universal MFA adoption, and extreme caution when running untrusted software or commands are critical defenses against infostealer infections.

About the Speaker(s)

Will Frame is a 23-year-old pentester working with Bastion Security Group. Outside of his professional role, he is the creator of "reseller," a free info monitoring solution designed to help individuals and organizations track compromised credentials. His work and research in the cybersecurity space can be explored further on his personal website. Frame's experience as a pentester provides him with valuable insights into the methodologies and impacts of cyber threats like infostealers.