Inside the Information Stealer Ecosystem: From Compromise to Countermeasure

Inside the Information Stealer Ecosystem: From Compromise to Countermeasure

Speakers: Olivier Bilodeau, Security Researcher, Flair; Eric Clay, Threat Intelligence Analyst, Flair

Conference: ShmooCon

YouTube: https://www.youtube.com/watch?v=5YHcw-qj094

Overview

Information stealer malware represents a rapidly escalating and pervasive threat within the cybercrime landscape, often operating beneath the radar of mainstream security discourse that tends to focus on state-sponsored or high-profile ransomware attacks. This talk, delivered by Olivier Bilodeau and Eric Clay, provides a granular exploration of the info stealer ecosystem, dissecting its economic drivers, common infection vectors, and the sophisticated methods threat actors employ to monetize stolen data. The presentation moves beyond traditional credential theft, unveiling how these malicious tools pilfer a wide array of sensitive information, from session cookies capable of bypassing multi-factor authentication (MFA) to secrets stored in browser extensions and even personal documents.

The speakers underscore the sheer scale of the problem, revealing an alarming weekly volume of compromised logs circulating within underground markets. They delve into specific cases, including the high-profile takedown of the RedLine and Meta info stealer families, illustrating the collaborative efforts between private security firms and law enforcement to disrupt these operations. Crucially, Bilodeau and Clay also detail advanced defense and mitigation strategies, offering actionable insights for both end-users and organizational defenders. This includes an analysis of Google Chrome's Application-Bound Encryption (ABE) and its real-world impact on detection, alongside practical advice on user education and the effective use of security tools.

The talk serves as a critical wake-up call, emphasizing that the barrier to entry for cybercriminals is continuously lowering, driven by a robust "malware-as-a-service" economy. It highlights the intimate nature of the data compromised by info stealers, which extends far beyond login credentials to encompass personal and corporate files, browser history, and even sensitive authentication tokens. By exposing the inner workings of this pervasive threat, the speakers equip the audience with a deeper understanding of the risks and empower them with strategies to fortify their digital defenses against a menace that impacts millions globally.

Background

▶ Watch: Introduction to info stealer malware and its risks (0:00)

The proliferation of information stealer malware is fundamentally driven by a thriving cybercrime economy, often likened by the speakers to the principles of capitalism – making it "10% easier every year" for individuals to become threat actors. At its core, an info stealer is a type of remote access Trojan (RAT) designed to covertly infiltrate a computer system and exfiltrate sensitive data. This typically includes saved credentials from web browsers, session cookies, browser history, and in many cases, specific files residing on the victim's machine. The stolen data, often referred to as "Steeler logs," is then uploaded to command and control (C2) infrastructure, from where it is distributed and sold within various cybercrime marketplaces, including Telegram channels and dark web forums.

A critical aspect highlighted is the ability of info stealers to bypass multi-factor authentication (MFA). While users often rely on MFA for enhanced security, info stealers can circumvent this by capturing active session cookies. Threat actors can then replay these cookies in specialized anti-detect browsers to gain direct, authenticated access to applications without needing the victim's password or MFA token. This capability significantly elevates the risk associated with info stealer infections, turning what might seem like a simple credential theft into a full-scale account takeover.

The distribution mechanisms for info stealers are diverse and insidious. Common vectors include cracked software (e.g., pirated versions of Photoshop, 3D Studio, games), malicious advertisements on platforms like YouTube and Google Ads, and mobile app clones masquerading as popular applications. Threat actors often create elaborate schemes, such as uploading YouTube videos demonstrating how to use "free" cracked software, with a download link in the description. These videos frequently instruct victims to disable their antivirus software, further paving the way for infection. A particularly cunning method involves seeding "free sample" Steeler logs (often shared to entice buyers) with info stealer executables themselves, leading to threat actors infecting other threat actors. This highlights the chaotic and often self-destructive nature of the cybercrime ecosystem, where even criminals fall victim to their peers' schemes.

Key Findings

▶ Watch: Understanding the info stealer malware economy (3:00)

The research presented unveiled several significant findings regarding the information stealer ecosystem:

• Massive Scale and Economic Impact: The ecosystem is vast, with an estimated 1.4 million Steeler logs distributed weekly and over 65 million total logs identified by the researchers. Crucially, approximately 7 million of these logs almost certainly contain corporate credentials, underscoring their role in major enterprise breaches. The market is highly active, with malware variants like Atomic Stealer (targeting macOS for $1,000/month) and RedLine (Windows, $200/month) being openly advertised and sold.
• MFA Bypass Beyond Credentials: While often associated with password theft, info stealers are highly effective at bypassing MFA. This is primarily achieved through the exfiltration of session cookies, which can be replayed to gain authenticated access. A specific, alarming finding demonstrated that secrets from popular Chrome Authenticator extensions (e.g., the top-ranked "Chrome Authenticator") can be directly extracted from the browser's LevelDB database, allowing attackers to generate valid Time-based One-Time Passwords (TOTP).
• Comprehensive Data Harvesting: Info stealers go "beyond credentials" by implementing extensive file harvesting modules. They target small, "juicy" files such as documents, spreadsheets, and text files from desktops and document folders, avoiding large files like ISOs or VM images. They also target configurations for various software, including FTP clients, and a wide array of cryptocurrency wallets (e.g., Binance, Phantom, MetaMask, Electrum), Discord, Telegram, AnyDesk, VPN clients, and Azure tokens.
• RedLine/Meta Takedown Strategies: The talk detailed the successful, multi-stage takedown of the dominant RedLine and Meta info stealer families. Initial disruptions involved the revocation of shared code signing certificates. Subsequent efforts targeted their dead drop resolvers hosted on legitimate services like GitHub and Pastebin, which stored encrypted blobs containing C2 infrastructure IPs. This forced the malware operators into a "whack-a-mole" scenario, significantly disrupting their operations and ultimately leading to a full law enforcement takedown (Operation Magnus).
• Threat Actor Self-Infection: A fascinating observation was the prevalence of threat actors infecting each other. This often occurred when criminals downloaded cracked versions of "checker" tools (used to analyze Steeler logs for specific high-value targets like bank accounts or Netflix sessions). These cracked checkers were intentionally backdoored with info stealers by other, cleverer threat actors, leading to the compromise of their criminal infrastructure and personal data.
• Chrome's Application-Bound Encryption (ABE) Analysis: Google's implementation of ABE, designed to encrypt browser data files and require an elevated service for access, was analyzed. While quickly bypassed by new techniques (e.g., headless Chrome debugging, COM object impersonation, registry key manipulation), the speakers argued that ABE still offers a significant defensive improvement. It shifts the attack vector from simple file I/O (hard to detect) to actions requiring administrator privileges, specific command-line parameters, or memory offsets, all of which are much easier for Endpoint Detection and Response (EDR) solutions to detect and log.

Technical Deep Dive

▶ Watch: Common distribution vectors for info stealer malware (4:15)

The technical intricacies of information stealers reveal a sophisticated, albeit often crude, operational model designed for maximum data exfiltration and monetization. A typical Steeler log is a bundle of exfiltrated data, often presented in a structured format by the malware. It includes:

• Autofill Data: Information saved by the browser for form completion, such as names, addresses, and even sensitive numbers like Social Security, if stored.
• Passwords File: A collection of all credentials saved within various browsers detected on the system (e.g., Chrome, Firefox, Edge). Interestingly, the speakers noted RedLine's own advertisements sometimes appearing within these password files, showcasing the malware's pervasive reach.
• Session Cookies File: Crucial for bypassing MFA, these cookies allow threat actors to impersonate the legitimate user and gain direct access to online services. This is often achieved using anti-detect browsers that can load these cookies and recreate the victim's browsing environment.
• processes.txt: A list of running processes, which can help threat actors understand the victim's system configuration and installed software.

Beyond these core components, the talk highlighted several advanced data exfiltration techniques:

MFA Bypass via Browser Extensions: A particularly concerning finding involved the direct extraction of Time-based One-Time Password (TOTP) secrets from popular Chrome Authenticator extensions. These extensions store their secrets in a LevelDB database, a key-value store used by Chrome extensions. The malware can access these user-space files without elevated privileges. Olivier Bilodeau demonstrated that by extracting the JSON-formatted data from the LevelDB file, the secret parameter for a TOTP account could be retrieved. This secret, when fed into any web-based TOTP generator synchronized to the correct time, produces the identical MFA code as the victim's browser extension, rendering the second factor useless. The path to these extension folders is typically hardcoded in the malware, allowing it to specifically target known vulnerable extensions.

Password Manager Extensions: While browser-based password managers are highly vulnerable, dedicated password manager extensions showed varying levels of resilience. Bitwarden, for instance, encrypts all individual entries, including usernames and URLs, within its local data files, making direct extraction of plaintext credentials impossible without the master password. Dashlane and KeePass XC extensions were found to store no sensitive content locally, relying on cloud transactions or communicating with an external, encrypted vault, respectively. This indicates that well-designed password managers significantly increase the security against info stealers.

Password Vaults (e.g., KeePass): Info stealers will attempt to exfiltrate standalone password vault files (e.g., .kdbx files for KeePass). While the files themselves are encrypted and not altered by the malware, the risk emerges if the master password for the vault is stored unencrypted elsewhere on the system (e.g., in a compromised browser password database) or if the master password is weak enough to be brute-forced offline. Tools like John the Ripper can extract the PBKDF2 hash from a KeePass database, which can then be subjected to offline cracking attempts using powerful GPU-accelerated tools like Hashcat.

Google Master Cookies: The talk introduced the concept of "Google Master Cookies," described as a "long blob of Base64 encoded stuff." These are not standard session cookies but rather a master seed that, when processed by specific C2 tools, can generate working session cookies for various Google applications. This suggests a persistent Google authentication algorithm that, if changed, would likely necessitate revoking all user sessions globally, a move Google is understandably reluctant to make.

"Checker" Tools: To efficiently process the vast volume of stolen logs, threat actors utilize "checker" tools (e.g., BL Tools Checker). These applications automate the analysis of thousands of Steeler logs, identifying active session cookies for specific high-value targets like Netflix, bank accounts, or crypto exchanges. Threat actors can configure custom URLs for checkers, streamlining the process of finding monetizable accounts.

Application-Bound Encryption (ABE) in Chrome: Google's ABE aims to protect browser data by encrypting files and requiring an elevated service (running as admin) to broker access. This means direct file I/O on encrypted data is no longer sufficient for malware. While bypasses emerged quickly—such as launching a headless Chrome instance with remote debugging enabled, interacting with the elevated service via COM objects to impersonate Chrome, or modifying registry keys to force Chrome to start unencrypted—Olivier Bilodeau argued that these bypasses still represent a net gain for security. They transform a stealthy file access operation into one requiring admin privileges, specific command-line parameters, or memory offsets, all of which leave significantly more detectable traces for EDR and forensic analysis.

Demo / Proof of Concept

▶ Watch: Inside a threat actor's guide to luring victims (5:05)

The talk incorporated several compelling demonstrations and proofs of concept to illustrate the mechanics and impact of information stealers.

One powerful demonstration was the "victim screenshot" series, a collage of actual screenshots taken from an infected user's computer by an info stealer. This sequence vividly depicted a typical infection chain:

1. The user searches for "Mid Journey," a legitimate AI image generation tool.
2. They navigate to a convincing but malicious website, "ai-midjourney.org," which offers a "free" download.
3. The user downloads and attempts to execute mid_setup.exe.
4. They encounter warnings about antivirus detection and proceed to disable BitDefender Antivirus 2023 and Windows Protection.
5. The malware continues to consume resources, leading the user to search for "AI mid journey or virus?"
6. Ultimately, the user attempts to delete everything, but the system is already compromised, leading to the potential for a "triple extortion ransomware attack." This narrative powerfully conveyed the common user behaviors exploited by info stealers.

A key technical proof of concept involved the direct extraction of MFA TOTP secrets from a Chrome Authenticator extension. Olivier Bilodeau demonstrated the process:

1. He installed the same Chrome Authenticator extension on his own browser.
2. He configured a TOTP account using a QR code.
3. He then located the extension's data files (a LevelDB database) within his user profile, accessible without admin rights.
4. He extracted the JSON content from this database, specifically identifying the secret parameter associated with his TOTP account.
5. Using a generic web-based TOTP generator, he input the extracted secret.
6. Crucially, he was able to generate identical TOTP tokens as his browser extension, confirming that the secret could be fully compromised and used to bypass MFA. This practical demonstration highlighted a critical vulnerability in how some browser-based authenticators store sensitive data.

Finally, the talk included a segment from the "Operation Magnus" takedown video, produced by law enforcement agencies involved in disrupting the RedLine/Meta operations. While not a live technical demo by the speakers, this video served as a public demonstration of the successful, large-scale disruption of a major info stealer family, featuring screenshots of the malware's builder interface and acknowledging the various international collaborators, humorously dubbed "VIPs" (Very Important to the Police).

Defensive Implications

▶ Watch: The market for stolen info stealer logs on Telegram (6:05)

Defending against information stealers requires a multi-layered approach, combining user education, robust security tools, and proactive monitoring.

User Education and Awareness:

• Admin Rights Not Required: Users must understand that info stealers often operate in user space, meaning they can infect a machine and steal vast amounts of data without needing administrator privileges.
• Avoid Cracked Software and Malicious Ads: This is the most critical advice. The vast majority of infections stem from downloading pirated software, games, or fake updates, often linked from YouTube videos or malicious Google Ads. The speakers emphasized that "there is rarely a reason to disable AV" and that users should never do so, especially when installing software.
• Don't Share Work Computers: Mixing personal and professional use, particularly allowing family members to use work devices, significantly increases the risk of corporate compromise.
• Study a Steeler Log: The speakers strongly encouraged security professionals to examine a real (sanitized) Steeler log to grasp the "intimate" and extensive nature of the stolen data.

Technical Defenses:

• Password Managers: While browser-based password managers are vulnerable, dedicated, well-architected solutions like Bitwarden, Dashlane, and KeePass XC offer superior protection. Their encryption schemes or reliance on external vaults make them significantly harder for info stealers to compromise directly.
• Windows SmartScreen: This built-in feature is effective at blocking malicious files masquerading as legitimate software downloads, preventing many initial infection attempts.
• Ad Blockers: Using an ad blocker can prevent users from encountering malicious advertisements that lead to info stealer downloads.
• Antivirus/EDR: While traditional AV sometimes struggles with the evolving nature of info stealers, the speakers noted that operating system vendors (like Google with Chrome's ABE) are making strides that improve telemetry and detection capabilities. Even if ABE can be bypassed, the bypass techniques often require actions (admin privileges, specific command-line parameters, memory offsets) that are far more detectable by EDR solutions than simple file I/O. This shifts the detection challenge from a "noisy" file system to more specific, observable behaviors.

Proactive Monitoring and Remediation:

• Monitor Steeler Log Databases: Organizations should actively monitor publicly available Steeler log databases through threat exposure vendors. This allows them to identify if corporate credentials or accounts have been compromised.
• Test Compromised Accounts: Upon identification, organizations should immediately test these accounts, reset passwords, and revoke sessions to prevent costly incidents. This can also help uncover "shadow IT" – forgotten or unauthorized services not protected by corporate SSO.
• Community Contributions: The speakers offered two "community gifts": a Powershell script for testing credentials against Entra ID (formerly Azure AD) to check for MFA bypasses or account reset capabilities, and a set of sanitized "bad guy" Steeler logs for educational purposes (shared under TLP Amber protocol). These resources empower defenders to proactively assess their exposure and understand the threat.

Key Takeaways

• Information stealer malware is a pervasive and economically driven threat, responsible for millions of compromises annually, often bypassing MFA.
• The primary infection vectors include cracked software, malicious advertisements on platforms like YouTube and Google Ads, and fake updates.
• Beyond credentials, info stealers harvest extensive personal and corporate files, browser history, browser extension data (including MFA TOTP secrets), and generate persistent session cookies.
• Robust, dedicated password managers like Bitwarden, Dashlane, and KeePass XC offer significantly better protection against info stealers compared to browser-based password saving.
• Google Chrome's Application-Bound Encryption (ABE), despite quick bypasses, improves defensive posture by making attack techniques more detectable by EDR solutions.
• Proactive monitoring of stealer log databases for corporate credentials, coupled with strong user education against risky online behaviors, is crucial for effective defense.

About the Speaker(s)

Olivier Bilodeau is a security researcher, identified as an "open source guy" who enjoys providing "community gifts" to conference attendees. His expertise lies in deep technical analysis of malware and defensive strategies, particularly evident in his deep dive into MFA bypasses and Chrome's Application-Bound Encryption. He is associated with Flair, a sponsor of the ShmooCon conference.

Eric Clay is a threat intelligence analyst, who initiated the talk by engaging the audience on common security practices like saving browser credentials and downloading cracked software. His contributions focused on the broader ecosystem, economic drivers, and distribution methods of information stealers, as well as the observed behaviors of threat actors within the cybercrime landscape. He is also associated with Flair.