LLM Identifies Info Stealer Vector & Extracts IoCs
Demonstrates leveraging multimodal LLMs to analyze millions of infostealer infection screenshots and autonomously extract indicators of compromise.
Summary
The Threat of Information Stealer Malware
Information stealer malware families (such as RedLine, Lumma, and Vidar) harvest millions of credentials, session cookies, and browser tokens daily, flooding underground cybercrime markets.
Mining Stealer Screenshot Logs
Infostealers frequently capture desktop screenshots at the moment of infection. Analyzing these visual artifacts reveals the exact infection vector, open browser tabs, and malicious download sources.
Automating Multimodal LLM Extraction Pipelines
Olivier Bilodeau and Estelle Ruellan introduce an automated processing pipeline using vision-capable LLMs to parse millions of infection screenshots, classify attack vectors, and extract Indicators of Compromise (IoCs).
Actionable Telemetry for Threat Intelligence
Deploying AI-driven screenshot analysis accelerates threat attribution, identifies active malvertising campaigns, and produces high-fidelity threat intelligence at scale.
Related talks
FIRST·25 min
Steve Devera · Vamsi Krishna · Sydney Sweeney
Presenters detail vulnerability discovery and exploitation in Beyond Human Scale: AI and Automation as Force Multipliers in Cyber Threat Intelligence.
Briefings·41 min
Estelle Ruellan · Olivier Bilodeau
Threat analysts uncover operational security blunders and digital breadcrumbs left by state-sponsored threat actors during cyber heists.
Main Stage·40 min
Yisroel Mirsky
Side-channel traffic analysis attack that intercepts and reconstructs confidential AI assistant chat conversations across major platforms.