Home / Blog / News and Research / [New Research] Inside Infostealer Attacks 

[New Research] Inside Infostealer Attacks 

Infostealer attacks remain a persistent threat to organizations. In August 2026, Australian authorities charged two men over their alleged involvement with TeamPCP, a cybercrime group linked to software supply chain attacks targeting development-related GitHub projects. The group used credential-stealing malware to collect secrets including AWS keys and API tokens. The Australian Federal Police said the wider campaign potentially affected more than 1,000 organizations and exposed more than 500,000 credentials.

TeamPCP is part of an increasingly commercialized infostealer ecosystem. Malware developers today operate much like software-as-a-service vendors, selling subscriptions for as little as $120/month on dark web forums like Exploit and BreachForums (now taken down).

The main threat to organizations, and the challenge security teams must solve, is that infostealers create a problem that persists long after the initial infection. An infostealer only needs a short window on an endpoint to collect sensitive data. Once that information leaves the device, removing the malware does not make the stolen credentials disappear, and they may remain useful to attackers for months or even years.

This research coincides with the latest addition of over 46 million compromised passwords to the Specops Breached Password service. These passwords come from a combination of our honeypot network and threat intelligence sources, including infostealer log monitoring.

What Does an Infostealer Do?

An infostealer is malware designed to collect sensitive information from an infected device and send it back to an attacker. Well-known families include Lumma Stealer (or LummaC2), RedLine, Vidar, Raccoon Stealer and Atomic Stealer. Unlike ransomware, the objective is not usually to disrupt the victim. An infostealer is valuable for quietly collecting authentication data before the organization realizes anything is wrong.

Infostealers are also distinct from Remote Access Trojans (RATs) and loaders:

• RATs are designed to give an attacker ongoing remote access to a compromised system. Agent Tesla is a long-standing example of malware with RAT-style functionality.
• Loaders primarily establish footholds and install additional malware. Examples include Amadey and Olymp Loader.
• Infostealers have a more focused purpose: find valuable data, collect it and exfiltrate it.

These categories are not always clear-cut, with many malware families combining capabilities. For example, RedLine is primarily an infostealer, but includes a “Loader Tasks” module to send new instructions or install additional payloads.

How Does an Infostealer Attack Unfold?

Step 1: Delivery

Phishing emails remain a common infostealer delivery route, but attackers also use compromised websites, malicious advertising and search engine optimization (SEO) poisoning to push fake software installers and cracked applications.

Threat actors also target developers by planting malicious code in open-source repositories, packages or development tools, as seen in the TeamPCP campaign. In other cases, a loader already present on the device installs the infostealer as a secondary payload.

The ‘ClickFix’ social engineering technique has also gained popularity in recent years. ClickFix exploits familiarity with CAPTCHA verification, presenting users with an error message after “failing” a prompt. They are then instructed to open Windows Run and paste in a verification code that contains a hidden PowerShell script, which then downloads the stealer malware.

Step 2: Execution and Discovery

Once the malware runs, it starts identifying information worth stealing. For instance, LummaC2 obtains system information by running several Windows API calls.

Example of system information gathered by LummaC2 (source)

From there, the infostealer searches locations where valuable data is likely to be stored. Web browsers are key targets because many applications are accessed through them; as such, they often contain saved passwords, cookies, and other authentication data. Infostealers will also search local folders, applications and developer tools for sensitive information.

Step 3: Data Collection

Depending on its capabilities, an infostealer may collect:

• Saved usernames and passwords
• Session cookies and authentication tokens
• Autofill data
• API keys and cloud credentials
• Cryptocurrency wallet data
• Documents and other local files
• Developer secrets and source-code repository credentials
• System and application information

Data pulled by an infostealer

Browsers typically encrypt saved credentials, payment details and other autofill data at rest. However, they must also be able to decrypt this data when needed, often without an additional password or security token. Infostealers can abuse this access to recover encryption keys and extract stored data. Where possible, use a dedicated password manager with a separate unlock mechanism rather than relying solely on browser storage.

The example below shows the information an infostealer scraped from an infected device with both Chrome and Brave installed. The infostealer collected data from profiles in each browser, including credentials and session information that could potentially be used to access the victim’s accounts without compromising the device again.

Data pulled from browsers by an infostealer

Step 4: Packaging and Exfiltration

Once the collection stage is complete, the malware packages the stolen information for exfiltration. The resulting stealer log contains folders or files covering browser data, credentials, cookies, system details and other information taken from the device.

Usable logins (PII removed)

The log is then sent to a command-and-control (C2) server for the attacker to review and decide the next steps. That means by the time the malware is detected and removed, authentication data may have already left the device and could be in use elsewhere.

How Can You Find Compromised Passwords in Your Network?

This month’s update also adds 5.4 million compromised passwords to the express blocklist used by Specops Password Auditor. These updates are drawn from many sources, including infostealer logs currently available on the dark web.

Specops Password Auditor provides a straightforward way to check for your existing exposure. The free, read-only scan of your Active Directory identifies passwords currently in use that are known to have appeared in breached password datasets. It also identifies accounts using expired, identical, or blank passwords.

Identifying those accounts gives organizations an opportunity to change exposed passwords before they can be used for account takeover or further access.

What Happens to Stolen Infostealer Data?

The teams carrying out infostealer attacks typically monetize the logs once collected. Depending on the quality of the contents, they might be sold for as little as $10, or more than $100 for particularly high-value credentials.

Alien txtbase credentials available for sale

When Old Credentials Lead to New Breaches

Recent campaigns highlight why infostealer risk doesn’t end once the malware is deleted from an endpoint. If credentials taken during the infection remain unchanged, attackers can still use them long after the original malware has disappeared.

IGN Twitch stream hijack: In June 2026, a self-identified white hat hacker hijacked the Restream account of a senior video director and launched a stream on IGN’s official Twitch channel. The credentials had appeared in infostealer dumps dating back to April 1, meaning they were exposed for over a month before being used.

Hacked IGN Twitch stream

Snowflake customer breaches: The 2024 Snowflake breaches affected major brands like Ticketmaster and AT&T, through credentials that were primarily stolen by infostealers. Mandiant found that at least 79.7% of the accounts used by the attacker had previously exposed credentials, with some traced back to infections from November 2020.

How Can Organizations Defend Against Infostealer Attacks?

Defending against infostealer attacks means addressing two separate problems: stopping the malware from running in the first place and limiting what attackers can do with credentials they manage to steal.

• Use layered endpoint protection: EDR and antivirus help detect or block infostealers before they collect data. Restricting unapproved software and scripts also reduces the chance of users running common delivery mechanisms.
• Control where software comes from: Organizations should limit downloads to trusted sources and apply extra scrutiny to third-party packages. Developers should verify packages and repositories before introducing them into production environments.
• Strengthen authentication and access controls: MFA, least-privilege access and conditional access policies can make stolen credentials less useful. Phishing and fatigue-resistant MFA is particularly valuable to mitigate the risk of attacks like prompt bombing.
• Monitor for unusual authentication activity: Sign-ins from unfamiliar locations, devices or networks, unexpected MFA activity and unusual access patterns all indicate that stolen credentials are being used.
• Identify and change passwords that are known to be compromised: Breached password monitoring can highlight credentials that are already present in known breach datasets, allowing organizations to replace them before attackers use them.

Preventing Breached Passwords from Being Used

Specops Password Auditor provides a useful snapshot, but that is all it is. A password that is safe today could appear in a new infostealer log or breach dataset tomorrow. Organizations therefore need an ongoing way to prevent known-compromised passwords from remaining part of their identity environment.

Specops Password Policy provides that continuous layer of protection. Its Breached Password Protection capability continuously monitors Active Directory against a database of more than 6 billion breached passwords. The service is updated daily using our research team’s threat monitoring data collection systems, helping organizations identify compromised passwords as they appear. At the same time, granular policy controls help prevent users from choosing weak or known-breached passwords in the first place.

To see how Specops can help reduce the risk posed by infostealer attacks, book a demo today.

Last updated on September 15, 2026