LLM Identifies Info Stealer Vector & Extracts IoCs

Hackers Dropping Mid-Heist Selfies: LLM Identifies Info Stealer Infection Vector & Extracts IoCs

Speakers: Olivier Bilodeau, Estelle Ruellan

Conference: DEF CON 33

YouTube: https://www.youtube.com/watch?v=PHtTXqlViVk

Slides: https://media.defcon.org/DEF%20CON%2033/DEF%20CON%2033%20presentations/Olivier%20Bilodeau%20Estelle%20Ruellan%20-%20Hackers%20Dropping%20Mid-Heist%20Selfies%20LLM%20Identifies%20Information%20Stealer%20Infection%20Vector%20and%20Extracts%20IoCs.pdf

Overview

Information stealers are among the most damaging commodity malware families in circulation today. They silently harvest credentials, cryptocurrency wallets, and any other extractable data from infected machines, then exfiltrate the entire package to attacker-controlled infrastructure — typically Telegram channels or darknet markets. At DEF CON 33, Olivier Bilodeau and Estelle Ruellan presented a clever and counterintuitive approach to analyzing this threat at scale: using a large language model (LLM) to process the screenshots that information stealers themselves capture at infection time, extracting infection vectors and indicators of compromise (IoCs) from millions of victim machines' "selfies" taken mid-heist.

The talk reframes a forensic nightmare — millions of raw screenshot artifacts with no structured metadata — into a tractable threat intelligence pipeline, using AI to turn the stealers' own surveillance habit against them.

Background

▶ Watch: Finding: cracked software is the dominant infection vector visible in screens... (0:54)

What Is an Information Stealer?

Information stealer malware (infostealers) occupies a unique niche in the threat landscape. Unlike ransomware or APT implants, infostealers are designed to run once, collect everything extractable, and vanish — often without requiring administrator rights and without establishing persistence. The collected data typically includes:

• Saved browser credentials and cookies
• Cryptocurrency wallet files and seed phrases
• SSH and RDP credentials
• Autofill data including credit card numbers
• Screenshots and clipboard contents
• System information (hardware IDs, installed software, OS version)

The exfiltrated packages ("logs") are sent to Telegram bots or dedicated C2 infrastructure, then bundled and sold on cybercrime forums in bulk. Individual buyers use these logs to take over accounts, drain cryptocurrency wallets, and conduct further fraud.

The Scale Problem

Bilodeau and Ruellan's team collected millions of infostealer log archives. Inside each log, beyond the credential and wallet files, is a screenshot taken at the moment of infection — a snapshot of whatever the victim had on their screen when the stealer ran. This screenshot is intended as quality assurance for the cybercriminal: it confirms the stealer ran on a real human machine (as opposed to a sandbox), and helps buyers assess the value of the log.

But from a defender's perspective, these screenshots are an extraordinary but largely untapped artifact. If you can analyze them at scale, you can potentially:

• Identify how victims got infected (the infection vector visible on screen)
• Extract IoCs like malicious URLs, file paths, and domain names visible in browser windows or application dialogs
• Understand the demographics and geography of victim populations
• Discover new malware distribution campaigns before they are otherwise detected

The challenge is scale: analyzing millions of screenshots by hand is impossible, and traditional computer vision techniques (OCR + regex matching) are brittle against the variety of visible content.

Why Screenshots Are Hard for Sandboxes

Infostealers increasingly include screenshots as an anti-sandbox check. Legitimate security sandboxes running automated analysis typically have minimal desktop activity — no browser windows open, no documents being edited. A screenshot showing a cluttered desktop, an open browser with tabs, and active applications is strong evidence of a real victim. This anti-evasion strategy is now mainstream in the infostealer ecosystem.

Key Findings

▶ Watch: Problem framing: screenshots in infostealer logs are underutilized threat intel (1:49)

• LLMs can accurately classify infection vectors from screenshots at scale. The research demonstrates that a properly prompted LLM can examine a victim's screenshot and classify the visible infection vector — e.g., "victim was watching a cracked software download tutorial," "victim clicked a malicious PDF attachment," "victim was on a cryptocurrency forum."

• The technique extracts actionable IoCs directly from screenshot image content. URLs visible in browser address bars, file names in download dialogs, and domain names in open email clients are extracted and structured as IoCs, feeding directly into threat intelligence pipelines.

• Screenshots are a previously underutilized gold mine in infostealer intelligence. Prior to this work, the security community largely focused on the credential and wallet components of stealer logs; the screenshot artifact was either ignored or used only for manual cherry-picking.

• Cracked software remains the dominant infection vector. Across the corpus of millions of screenshots, cracked/pirated software download pages and "keygen" sites were identified as the most prevalent visible infection vector, consistent with other industry reporting but now quantifiable at a previously impossible scale.

• The approach is operationally scalable and cost-effective. Using commercially available LLM APIs with carefully designed prompts, the team processes large volumes of screenshots for pennies per image, making this viable for SOC operations and threat intelligence teams.

Technical Deep Dive

▶ Watch: Key result: 100% accuracy for infection vector classification, 85% IoC extrac... (11:15)

The Pipeline Architecture

The research pipeline has several stages:

1. Log ingestion: Infostealer log archives are collected from OSINT sources, law enforcement partnerships, and cybercrime forum monitoring. Each archive is extracted to obtain the screenshot artifact.

1. Screenshot preprocessing: Images are normalized for resolution and format. Screenshots that are clearly sandbox artifacts (blank desktop, minimal content) are filtered out using simple heuristics.

1. LLM prompting for infection vector classification: The screenshot is submitted to an LLM (the team evaluated multiple commercial and open-source models) with a carefully engineered prompt instructing the model to:

• Describe what is visible on screen
• Identify any software installation, download activity, or suspicious content visible
• Classify the probable infection vector from a defined taxonomy
• Express confidence in the classification

1. LLM prompting for IoC extraction: A second prompt pass (or a single multi-task prompt) instructs the model to:

• Extract all visible URLs from browser address bars and open windows
• Extract file names and paths visible in dialogs or file managers
• Extract domain names from email clients or messaging apps
• Output these as structured JSON for downstream ingestion

1. Structured output validation: The LLM outputs are validated against IoC format schemas (URL syntax, domain patterns, file path patterns) and deduplicated.

1. Threat intelligence integration: Validated IoCs are submitted to internal threat feeds and correlated with known malicious infrastructure.

Prompt Engineering Considerations

A significant portion of the research focused on prompt engineering. Key techniques included:

• Few-shot examples: Providing the model with 3-5 annotated screenshot examples in the prompt significantly improved classification accuracy, particularly for distinguishing between infection vectors that have visually similar presentations.
• Structured output constraints: Requiring the model to output JSON with specific field names and allowed values for infection vector classification reduced hallucination and parsing errors.
• Confidence scoring: Asking the model to explicitly state its confidence level allowed low-confidence classifications to be routed for human review rather than fed directly into automated pipelines.
• Multi-pass refinement: For ambiguous screenshots, a second LLM pass with a more targeted prompt (e.g., "Is this a cracked software site or a legitimate download page?") resolved many edge cases.

Model Selection

The team evaluated several LLM options for this use case, including GPT-4V, Claude, and open-source vision models. The commercial vision-capable models outperformed smaller open-source models on screenshot classification accuracy, particularly for non-English content and for identifying brand-specific UI elements (recognizing that a visible window is a cracked software site vs. a legitimate software vendor portal).

Cost modeling showed that processing screenshots at scale using commercial APIs was economically viable for enterprise threat intelligence programs, though the team also explored local deployment of capable open-source vision models for air-gapped or cost-sensitive environments.

The "Mid-Heist Selfie" Insight

The colorful framing of the talk title — "hackers dropping mid-heist selfies" — reflects a genuine insight about attacker operational security failures. By automatically capturing and exfiltrating screenshots, infostealers create a forensic record of the victim's state at infection time. When combined with the rest of the log data (timestamps, system information, geographic indicators from IP addresses), this creates a remarkably complete picture of each infection event. The attackers never intended this data to be used against them — but in bulk, it becomes a threat intelligence resource that enables tracking infection campaigns, identifying malware distribution infrastructure, and understanding victim demographics in ways that static malware analysis cannot match.

Demo / Proof of Concept

▶ Watch: Live demo: LLM analyzing screenshots from real infected victim devices (24:47)

The talk includes live demonstrations of the pipeline processing real infostealer screenshots (with personally identifiable information redacted). The demo shows:

1. An infostealer log archive being ingested and the screenshot extracted.
2. The screenshot submitted to the LLM pipeline with the infection vector classification prompt.
3. The model correctly identifying a cracked Adobe Photoshop download page visible in the screenshot and classifying the infection vector as "cracked software distribution site."
4. The IoC extraction pass identifying the URL of the distribution site visible in the browser address bar.
5. The extracted URL being matched against known malicious domain lists and generating a threat intelligence alert.

A secondary demonstration shows aggregate analysis across thousands of screenshots: a distribution chart showing infection vector categories (cracked software, malicious email attachment, fake update page, cryptocurrency forum, etc.) and their relative prevalence, produced entirely from LLM-classified screenshot data.

Defensive Implications

▶ Watch: Timeline reconstruction: 19-hour attack window mapped from screenshot metadata (29:13)

For threat intelligence teams:

• Infostealer log screenshots should be added to standard analysis workflows. The IoCs they contain — particularly malicious URLs that may not appear in any other feed — can provide early warning of new distribution infrastructure.
• The pipeline described in this research can be deployed operationally with commercially available LLM APIs and modest engineering effort.

For incident responders:

• When analyzing an infostealer infection, recovering the screenshot artifact from the log can reveal the exact infection vector, dramatically accelerating root cause analysis.
• Screenshots may also reveal other infections on the same machine (visible browser tabs, open email clients with phishing content) that might otherwise require more invasive investigation.

For organizations:

• The research reinforces the dominant infection vector message: cracked/pirated software is the primary entry point for infostealer infections. Organizations should enforce software licensing policies and technical controls that prevent employees from installing unauthorized software.
• Multi-factor authentication on all accounts is essential, as infostealer logs are a primary source of the session cookies and credentials used in subsequent account takeover attacks.

For defenders against infostealers:

• The fact that infostealers take screenshots makes them detectable through EDR telemetry monitoring for unexpected screenshot API calls.
• Screenshot content analysis (as demonstrated in this research) can be applied in reverse: defensive tools monitoring for infostealer-like behavior could flag applications that are capturing screenshots outside of expected contexts.

Key Takeaways

1. LLMs with vision capabilities can process infostealer victim screenshots at scale to extract infection vectors and IoCs — turning attackers' own surveillance artifact against them.
2. Screenshots in infostealer logs are a systematically underutilized threat intelligence source, containing actionable IoCs (malicious URLs, domains, file paths) visible in victim desktop content.
3. Cracked/pirated software remains the dominant infostealer infection vector across millions of analyzed cases.
4. Careful prompt engineering — including few-shot examples, structured output constraints, and confidence scoring — is essential for reliable LLM-based screenshot analysis.
5. The pipeline is economically viable for operational deployment using commercial LLM APIs, making this approach accessible to enterprise threat intelligence programs.

About the Speaker(s)

▶ Watch: Extended capability: pivoting from screenshots to full victim system enumeration (42:18)

Olivier Bilodeau is a veteran threat intelligence and malware analysis researcher with extensive experience in tracking commodity malware ecosystems and building large-scale malware analysis infrastructure. He has spoken at numerous security conferences on malware analysis and threat intelligence.

Estelle Ruellan is a security researcher specializing in threat intelligence and AI/ML applications in cybersecurity. At DEF CON 33, she co-presented the LLM-based screenshot analysis pipeline, contributing to both the model evaluation methodology and the operational deployment considerations.