Securi-Tay 2025: InfoStealerz: The Phantom Menace

What Infostealers Are

A Talion threat-intelligence analyst opens Securi-Tay 2025 covering information stealers—malware harvesting passwords, crypto wallets, and session data, often sold via malware-as-a-service subscriptions resembling ransomware affiliate models. Methods include keylogging, browser hooking, and clipboard monitoring.

Major Families and Delivery

He surveys families such as Lumma, StealC, Raccoon, RedLine, Meta, RisePro, and Banshee, noting new strains appear constantly. RedLine spreads through phishing and fake cracked software; some MaaS operators run admin panels instead of bespoke C2. Infostealers frequently target MFA browser extensions before exfiltrating stored secrets.

Campaign Case Studies

Examples include GuardLabs’ “Deception” malvertising distributing Lumma via fake CAPTCHA pages that copy PowerShell one-liners to victims’ clipboards for Windows Run execution across thousands of sites. He also discusses Lua Nightmare (CVE-2024-49113) hype where a mislabeled GitHub proof-of-concept created confusion between related LDAP vulnerabilities after Microsoft’s December 2024 patches.