Infostealers Turn Millions of Devices Into Credential Theft Machines
Source SecurityWeek
Description
As attackers increasingly favor stolen credentials over exploits, infostealers have become a primary source of access for ransomware and other cybercrime operations. The post Infostealers Turn Millions of Devices Into Credential Theft Machines appeared first on SecurityWeek .
Impact
The impact of infostealers is significant as they enable attackers to gain authorized access to networks and systems using stolen credentials, bypassing many traditional security defenses. This access facilitates ransomware attacks and other cybercrime activities. The widespread infection of millions of devices and the circulation of billions of stolen credentials increase the risk of large-scale breaches and data theft. Victims often remain unaware of compromise until after damage occurs, complicating incident response. The availability of infostealers as malware-as-a-service lowers the barrier for attackers, increasing the prevalence and scale of these attacks.
Defensive guidance
Since infostealers rely heavily on social engineering for delivery and stealth techniques to evade detection, mitigation should focus on user education to resist phishing and social engineering attacks, deploying advanced endpoint detection and response solutions capable of identifying stealthy malware behaviors, and using multi-factor authentication to reduce the impact of stolen credentials. Network defenders should monitor for unusual authentication activity and consider credential hygiene practices such as regular password changes and credential vaulting. There is no indication that a specific patch or fix exists for infostealers themselves, as they are malware rather than software vulnerabilities.
Summary
Infostealers are a class of malware designed to steal credentials and other sensitive information from infected devices. They have become the favored method for attackers to gain access to targets, as stolen credentials provide authorized entry that is quicker and less detectable than exploiting vulnerabilities. In 2025, more than 11.1 million devices were infected, with over 3.3 billion credentials and related data circulating in underground markets. There are over 30 known strains of infostealers, with some like Vidar dominating infections in early 2026. These malware often evade detection by terminating in sandbox environments and using code obfuscation. They collect a broad range of data including website and enterprise credentials, browser cookies, session tokens, cryptocurrency wallet information, credit card data, and system metadata. The stolen data is encrypted and exfiltrated to attacker servers, where it is monetized or used to facilitate ransomware and other cybercrime operations. Infostealers are commonly distributed via social engineering attacks and are available as malware-as-a-service for low cost, making them accessible to a wide range of threat actors. Detection is challenging, and victims typically only become aware after credential misuse or marketplace exposure.
References
Community reviews
Related threats
- php2shell one week later: Why one exploit doesn’t work everywhereHighVulnerability
- ZDI-26-839: MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution VulnerabilityHighVulnerability
- ZDI-26-843: MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution VulnerabilityHighVulnerability
- ZDI-26-845: MLflow Statsmodels _load_model Deserialization of Untrusted Data Remote Code Execution VulnerabilityHighVulnerability
- Open-source tool for unpacking stripped Android native (.so) malware: static RegisterNatives recovery, ARM64 OLLVM (BR X8) deobfuscation, and Dobby anti-Frida tracingTool