Full Report
Cybercriminals are sitting on a pile of stolen credentials, financial information, and sensitive data, thanks to the success of infostealers. Read more to learn how infostealers have grown to become a scourge to defenders, and how businesses can protect themselves.
Analysis Summary
# Tool/Technique: Infostealers (Modern Malware Class)
## Overview
Infostealers are a class of malware designed to harvest sensitive information from infected systems. Originally focused on banking credentials (e.g., Zeus), they have evolved into a sophisticated "gateway" threat. They act as the primary reconnaissance and initial access mechanism for ransomware groups and extortionists, fueling a massive underground economy of stolen data sold on specialized marketplaces.
## Technical Details
- **Type:** Malware Family (General class with numerous variants)
- **Platform:** Windows, macOS (e.g., MacSync), Linux
- **Capabilities:** Credential harvesting, session hijacking, crypto-draining, system fingerprinting.
- **First Seen:** 2007 (Zeus variant)
## MITRE ATT&CK Mapping
- **[TA0006 - Credential Access]**
- [T1539 - Steal Web Session Cookie]
- [T1555 - Credentials from Web Browsers]
- [T1552.004 - Private Keys (SSH/Crypto Wallets)]
- **[TA0007 - Discovery]**
- [T1082 - System Information Discovery]
- **[TA0010 - Exfiltration]**
- [T1041 - Exfiltration Over C2 Channel]
## Functionality
### Core Capabilities
- **Browser Scraping:** Extraction of saved passwords, autofill data, and credit card numbers from Chrome, Firefox, Edge, etc.
- **Session Hijacking:** Stealing session cookies and JWT tokens to bypass Multi-Factor Authentication (MFA).
- **System Profiling:** Gathering hardware specs, IP addresses, geolocation, and installed software lists.
### Advanced Features
- **Modern Token Theft:** Specifically targeting Slack and Discord tokens, which provide persistent access to corporate communications.
- **Cloud/DevOps Targeting:** Extraction of AWS/Azure API keys, SSH keys, VPN configurations, and RMM/RDP credentials.
- **Anti-Analysis/Evasion:** Some variants (e.g., Celestial Stealer) maintain "Do Not Engage" lists, checking for specific researcher names or sandbox environments to terminate execution.
- **MFA Bypass:** Harvesting 2FA/OTP backup keys and recovery phrases.
## Indicators of Compromise
- **File Names:** `OpenClaw` (fake installers), `MacSync` payloads, files often found in `%AppData%` or `/tmp/` folders.
- **Network Indicators:**
- Connections to C2 servers via HTTP/S or Telegram API (defanged: `api[.]telegram[.]org`).
- Known marketplaces: `Russian Market`, `Genesis Market`.
- **Behavioral Indicators:**
- Unexpected PowerShell or Terminal commands (especially Go-based scripts).
- Rapid reading of browser profile directories (e.g., `...\User Data\Default\Network\Cookies`).
- Outbound traffic to known data-dumping sites or Discord webhooks.
## Associated Threat Actors
- **Scattered Spider** (Known for Slack token exploitation)
- **APT Groups** (Buying access from marketplaces)
- **Ransomware Affiliates** (Using stolen credentials for initial access)
## Detection Methods
- **Behavioral detection:** Monitoring for unauthorized access to browser credential stores and sensitive configuration files (VPN/SSH).
- **Process Monitoring:** Identifying anomalous Terminal/PowerShell execution originating from browser processes or downloaded installers.
- **Evasion Checks:** Detection of malware looking for specific security researcher names or virtualization artifacts.
## Mitigation Strategies
- **Token Management:** Implement shorter session lifetimes and revoke sessions immediately upon suspected compromise.
- **Phishing Protection:** Use FIDO2-compliant hardware keys (e.g., YubiKeys) which are resistant to session token theft.
- **Hardening:** Disable "Save Password" features in browsers; use a dedicated enterprise password manager.
- **Endpoint Protection:** Deploy EDR solutions capable of monitoring file system access to sensitive application data folders.
## Related Tools/Techniques
- **Malware Families:** Zeus, AZORult, Raccoon, Vidar, RedLine, MacSync, Celestial Stealer, GhostSocks.
- **Techniques:** ClickFix scams (social engineering to run malicious commands), Fake Installers (GitHub/SEO poisoning).