CampaignPublished 18 Jun 2025

May 2025 Infostealer Trend Report

Source AlienVault OTX General

Description

This analysis examines the distribution trends of Infostealer malware in May 2025. It highlights the use of SEO poisoning to distribute malware disguised as cracks and keygens. LummaC2, Vidar, StealC, Rhadamanthys, and Amadey were the main Infostealers observed. Distribution methods included posts on legitimate websites, forums, and Q&A pages. Malware was primarily distributed in EXE format (95.4%), with a decrease in DLL-SideLoading (4.6%). Notable trends include the emergence of BAT script malware, use of the Wormhole file-sharing service for distribution, and the use of Unicode characters in compression passwords to bypass security measures. The report provides insights into distribution volumes, methods, and disguises based on data collected and analyzed by advanced security systems.

Impact

For European organizations, the impact of these Infostealer campaigns can be significant. The theft of credentials and sensitive data can lead to unauthorized access to corporate networks, financial fraud, intellectual property theft, and reputational damage. Organizations with employees who may seek unauthorized software or cracks are particularly at risk due to the reliance on SEO poisoning and disguised payloads. The use of DLL side-loading and BAT scripts complicates detection and remediation efforts, potentially allowing malware to persist undetected for extended periods. The exploitation of legitimate websites and forums as distribution points increases the risk of widespread infections across diverse sectors. Additionally, the use of Unicode passwords in compressed malware archives may bypass traditional security scanning tools, increasing the likelihood of successful infections. The overall medium severity rating reflects a balance between the sophistication of the attacks and the requirement for user interaction (downloading and executing malicious files), but the broad distribution methods and variety of malware families involved suggest a persistent threat that could disrupt business operations and compromise sensitive data across Europe.

Defensive guidance

1. Implement advanced web filtering and DNS security solutions to detect and block access to known malicious domains and SEO-poisoned URLs, especially those offering cracks, keygens, or pirated software. 2. Educate employees about the risks of downloading and executing unauthorized software, emphasizing the dangers of SEO poisoning and social engineering tactics. 3. Deploy endpoint detection and response (EDR) tools capable of identifying obfuscated scripts, DLL side-loading attempts, and suspicious BAT script executions. 4. Enhance email security with sandboxing and attachment scanning to detect phishing attempts and malicious payloads. 5. Regularly update and patch all software and operating systems to reduce the attack surface and prevent exploitation of known vulnerabilities. 6. Use multi-factor authentication (MFA) to limit the impact of credential theft. 7. Monitor network traffic for unusual outbound connections that may indicate data exfiltration. 8. Incorporate scanning tools that can handle compressed archives with Unicode passwords or implement manual inspection protocols for suspicious compressed files. 9. Restrict execution of scripts and unsigned executables via application whitelisting and group policy controls. 10. Collaborate with threat intelligence providers to stay updated on emerging Infostealer hashes and indicators of compromise (IOCs) for proactive defense.

Indicators of compromise

Hashes 11

004c10450f71260bfaecf6af97412749
00d9c70434cdf4d83dd9b98e644597fa
09825dd40ba8ba3c1ce240e844d650a8
119a118372a79cfd77a033c852bd3f90
13a137bd40d2e80631643edb02c1c3ec
2e83c4ee2a8f68df5dada72f7cc5ae0eb857c023
33fdb830d5dedb058654725035c904c85180269d
3455a11cc4e698c4fc931bf822920972192577dc
1cefa4d9f9015053c21d2baccb1d95dad2240c8de0dc630fdbc94fbeddf192e3
9d153a59f7a0c6d457f71d0643fef5e3c60984c2da3564e9236fe6df834f1b60

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 18 Jun 2025, 20:03 UTC

MITRE ATT&CK techniques8 from threat tags

Technical details

Indicators of compromise

Hashes 11

Community reviews

Related threats