Infostealer - what a menace, man

The talk gives an overview of infostealers, malware that collects saved browser passwords, session cookies, payment cards, wallets and system details from infected machines. It covers common delivery routes such as phishing, fake software, cracked programs and poisoned repositories, and explains how malware-as-a-service operators sell licences, run support channels and push updates to get past new browser protections.

The middle section follows the stolen data into the underground economy. Initial access brokers buy remote access to corporate networks harvested from logs, while marketplaces list victim records by country and infection type. Telegram channels share samples, republish log dumps and offer lookup and cookie-checking services. Examples of operators leaving the market and of fake tools and comment spam used as lures show how quickly the ecosystem shifts.

The closing part describes a rough analysis of large public credential collections. Duplicates were removed and email addresses were matched against registries, bug bounty platforms and cybercrime forums, with some notable overlaps reported. The takeaway is that infostealer logs are useful for account takeover prevention, exposure monitoring and tracking threat actors, but the data is noisy and needs heavy cleaning before any analysis.