TI-2026-025C โ โThe Infostealer Pipeline: From Browser to Sprayโ
๐ Executive Summary
The decisive evidence in this campaign is not the common passwords. It is the zero-breach private credentials. Two credentials tied to library.shuffle-on.com returned 0 Have I Been Pwned results: one was the original private password saved in a browser; the other was a manually-derived variant that appears to have been created by the attacker after studying the original. Those two facts together reconstruct the supply chain.
This dossier maps the full path: a trusted friend saves a password in a browser; the friend's machine is later infected by infostealer malware; the browser credential store is extracted into a machine-level โlogโ; the log is sold on a market where domains are searchable; a buyer finds shuffle-on.com or sonatural.life; a human analyst studies the material, derives new target-specific passwords, and deploys the resulting spray through bulletproof infrastructure including MEVSPACE-linked space already implicated elsewhere in the series.
The conclusion is narrow and strong: the origin of the private credentials is not breach reuse, not public indexing, not a registration leak, and not random guessing. It is an infostealer compromise of a trusted associate's browser password manager, followed by skilled human post-processing.
๐ Finding 1 โ The Proof: Zero-HIBP Credentials
| Credential | Context | HIBP | Interpretation |
|---|---|---|---|
[REDACTED] | Private Calibre-Web password for library.shuffle-on.com | 0 | Not present in public breach corpus |
[REDACTED] | Manually derived variant used in the campaign | 0 | Attacker-created derivative, not historically leaked |
These credentials existed only inside a private Calibre-Web instance shared with a very small circle of trusted friends. The service was never a public consumer property. It had no public registration flow, ran on a non-standard port, and was not indexed by search engines. The exposure surface was therefore not โthe internetโ in the abstract. It was a browser that had once stored the secret.
That matters because HIBP=0 does not mean โthe credential never left the machine.โ It means it never entered the breach corpora publicly crawled and normalized by Troy Hunt. Infostealer markets sit outside that visibility. A credential can be absent from every breach dump HIBP knows about and still be actively traded in criminal log shops.
๐ Finding 2 โ The Calibre-Web Vector
library.shuffle-on.com was a self-hosted ebook library shared with roughly 5โ8 trusted friends in the 2023โ2024 period. It no longer appears as a public service. The simplest reconstruction is also the most forensic one:
- A friend accessed the service legitimately.
- The friend saved the credentials in their browser password manager.
- The friend's machine was later infected by infostealer malware.
- The browser store was dumped into a stealer โlogโ.
- The log was sold, searched, purchased, and operationalized.
Because the service was private, the credential is evidentiary in a way common passwords are not. It is a chain-of-custody artifact. A browser saved it; malware stole it; a market retailed it; an attacker used it.
๐ฆ Finding 3 โ The Infostealer Ecosystem: The โBig Fourโ Relevant to This Case
| Family | Period / Position | Model | Targets | Case Relevance |
|---|---|---|---|---|
| Lumma / LummaC2 | Most prevalent 2024โ2026 | MaaS subscription (~$250โ1000/month) + internal marketplace | Browsers, wallets, cookies, 2FA material | Romanian relevance: builds distributed via Romanian-language Telegram channels |
| RedLine | Dominant 2020โ2023 | Russian-speaking forum ecosystem | 100+ browser versions, local app data | Logs widely retailed via russianmarket.gs |
| Raccoon Stealer | v2 relaunched after developer arrest | Telegram-centric sales | Browser passwords, cookies, crypto | Still relevant as a credential-harvesting pipeline |
| StealC | Emerged 2023 | Budget MaaS (~$200/month) | Browsers, extensions, apps | Cheap enough for lower-tier but capable operators |
The importance of this ecosystem is structural: the attacker did not need a dramatic breach. They needed only one infected endpoint that had once opened the right browser profile.
๐ Finding 4 โ The Market Layer Is Domain-Searchable
These markets do not sell โjust passwords.โ They sell machine-state: all passwords, cookies, autofill, wallet artifacts, tokens, history, and local context extracted from one infected endpoint. The critical operational detail is that the market layer is often searchable by domain.
- Russian Market (
russianmarket.gs) โ active after Genesis Market's seizure; sells per-machine logs; buyers can search for domains likeshuffle-on.com. - LummaC2 Internal Marketplace โ closed ecosystem in which Lumma subscribers can search and buy logs generated by other Lumma infections.
- 2easy Shop โ historically associated with RedLine / Raccoon-style log resale.
That changes the threat model completely. If one associate saves a password for a niche private domain, any future buyer who types that domain into the market search bar can discover the entire infected endpoint containing it. According to the source framework cited for this layer โ Cloudflare Radar 2024 threat reporting, DeepStrike Intelligence, and KELA threat reporting โ the market has matured from wholesale dumps into searchable retail inventory.
โ๏ธ Finding 5 โ The Kill Chain Reconstruction (6 Stages)
- INFECTION โ A trusted friend visits a compromised site or opens a malicious PDF / Office document. Lumma, RedLine, Raccoon, or StealC executes.
- EXTRACTION โ The stealer dumps Chrome / Firefox password stores and finds
library.shuffle-on.complus[REDACTED]. - LOG PACKAGING โ The endpoint is packaged as a log: passwords, cookies, autofill, crypto wallets, sessions, and local context.
- MARKET LISTING โ The log appears on Russian Market or a LummaC2 marketplace, searchable by domain.
- PURCHASE โ A buyer searches
shuffle-on.comorsonatural.life, finds the log, and purchases it for roughly $5โ50. - WEAPONIZATION โ A human analyst studies the log, derives new password variants from observed patterns, assembles a custom wordlist, and deploys the spray through bulletproof infrastructure such as MEVSPACE.
This is the shift from malware collection to operator intent. The stealer performs the theft. The human performs the targeting.
๐ง Finding 6 โ Human Analyst Evidence, Not Raw Bot Spray
The attacker did not merely replay the log contents. They appear to have taken a base credential [REDACTED] and manually derived [REDACTED] using character substitution and suffix logic. That derivation implies understanding of password-construction habits. Automated commodity spraying normally reuses the raw contents of the purchased log. It does not infer style.
The broader campaign already showed 326 algorithm-generated variants. That is not opportunistic bot noise. It implies hours of study of the target's naming habits, lexical choices, and construction logic. The analyst treated the stealer log as a seed set, not a finished weapon.
Assessment HIGH confidence that a skilled human reviewed the material before spray deployment.
๐ Finding 7 โ HIBP Stratification Separates Public Reuse from Private Theft
| Credential Label | HIBP Count | Meaning |
|---|---|---|
Password A โ [REDACTED] | 1,045 | Widely leaked, multiple breach exposures |
Password B โ [REDACTED] | 901 | Common enough to recur, especially among Romanian users |
Password C โ [REDACTED] | 70 | Relatively rare, but still publicly represented |
Password D โ [REDACTED] | 0 | Infostealer-only signal |
Password E โ [REDACTED] | 0 | Derived by attacker; did not exist before creation |
This stratification matters because it shows two layers at once: common passwords can come from historical breach reuse; the zero-count private credentials cannot. The campaign combined both public and private sources โ breach material for baseline access testing, stealer-only material for targeted escalation.
๐จ Finding 8 โ June 2026 Stealer Logs Are an Urgent Lead
A major stealer-log addition reportedly introduced 56.3 million records on June 15, 2026. If accurate, that is not background noise; it is a fresh credential reservoir that may include new material for the same victim set, adjacent associates, or both.
Monitoring priority should therefore include shuffle-on.com and sonatural.life as market-search indicators, not just breach-monitoring indicators. The relevant question is no longer โdid this appear in a breach?โ but โdid this appear in a stealer retail inventory?โ
๐ณ๏ธ Finding 9 โ The Rhadamanthys Link Extends the Theory from 025B
From TI-2026-025B: a Rhadamanthys C2 node at 195.3.223.218 was identified on the same MEVSPACE /22 as attack IPs used in the credential campaign. Rhadamanthys is itself an infostealer. That does not prove identity, but it collapses distance.
- Rhadamanthys C2 and attack spray infrastructure appear in the same MEVSPACE address neighborhood.
- Same /22 can indicate the same customer allocation or adjacent criminal tenancy.
- The operator may not need to buy logs if they directly operate or partner with the stealer pipeline.
Theory MEDIUM confidence: the operator may have upstream access to the stealer ecosystem itself, rather than only downstream market access.
๐งฉ Finding 10 โ What the Attacker Probably Has But Did Not Use Here
The attacker used only the materials useful for SSH-adjacent credential testing. That implies restraint, not scarcity. A browser-derived log typically contains far more than a password pair.
- Browser cookies and live session material
- Autofill data and email aliases
- 2FA backup artifacts where stored locally
- Crypto wallet metadata and extensions
- Application credentials unrelated to SSH
The implication is severe: the visible spray may be only the narrowest operational use of a much larger private dataset.
โ Conspirative Questions
What if the MEVSPACE operator is also the infostealer operator?
The same /22 containing attack infrastructure and a Rhadamanthys C2 does not prove identity, but it makes clean separation less plausible. The closer the hosting overlap, the less convincing the โindependent buyerโ explanation becomes.
What if the โtrusted friendโ was targeted specifically to reach the real target?
That would turn this from incidental spillover into spearphishing with lateral credential acquisition. The social perimeter becomes the technical perimeter. The target was not the first infected machine โ just the intended beneficiary of the theft.
What if the June 2026 56.3M log dump belongs to the same collection wave that hit the friend?
Then the campaign may still be expanding. The initial spray would represent only the first use-case extracted from a much newer corpus that could continue to surface updated credentials and tokens.
What does HIBP=0 actually prove?
It proves absence from breach databases crawled by HIBP. It does not prove absence from criminal inventories. In this case, that distinction is the whole dossier: private browser theft can be commercially available while remaining invisible to public breach-indexing services.
Who benefits from attacking a threat researcher?
Possibilities include silencing pressure, counter-intelligence gathering, curiosity about what has already been observed, and pre-emptive compromise of someone actively mapping criminal infrastructure. The attack is not just credential acquisition; it is also informational pressure.
๐๏ธ Read Between the Lines
What the evidence says without saying it directly:
- The attacker did not use everything they bought. They selected only the SSH-relevant material. That means the unseen remainder may include cookies, session tokens, 2FA backups, and wallet-related artifacts.
- One infected friend is enough. Domain-searchable markets mean your credentials can become discoverable to anyone if a single associate stores them in a browser on a compromised machine.
- Genesis died; the market did not. Genesis Market was seized in April 2023. Russian Market and similar ecosystems filled the vacuum immediately. Takedown pressure redistributes inventory; it does not end the trade.
- HIBP is public hygiene, not criminal visibility. The adversary's private databases are often fresher, narrower, and operationally more relevant than public breach indexes.
- The malware theft and the human targeting are separate competencies. One actor may infect; another may retail; a third may analyze; a fourth may spray. The victim experiences them as one attack chain.
๐ Cross-References
- TI-2026-011 โ โThe Personal Touchโ โ original targeted credential campaign and the broader attacker knowledge profile
- TI-2026-025B โ โThe Rhadamanthys Linkโ โ MEVSPACE /22 overlap and infostealer infrastructure context
- TI-2026-007 โ โThe Underground Economyโ โ economic structure behind credential and access monetization
- TI-2026-019H โ โThe Feedback Loopโ โ how publication changes attacker behavior and why targeted operators matter
๐งช Method Note
Analytic basis: this dossier rests on negative-and-positive correlation, not one single indicator. The core proof is the conjunction of (1) private-service provenance, (2) HIBP zero-count results for the Calibre-Web credential and its derived variant, (3) market models that permit domain-based log discovery, (4) the observed human derivation behavior in the credential spray, and (5) the MEVSPACE / Rhadamanthys overlap documented in the preceding dossier.
Scope of claim: HIGH confidence that the private credentials originated in an infostealer-compromised browser password store belonging to a trusted associate. HIGH confidence that a human analyst weaponized the material after acquisition. MEDIUM confidence that the same actor directly operated the stealer infrastructure rather than purchasing from a marketplace.
Source layer named in this dossier: HIBP checks, campaign credential evidence from the Personal Touch series, service-history knowledge of library.shuffle-on.com, and reporting references provided for the market ecosystem: Cloudflare Radar 2024, DeepStrike Intelligence, and KELA threat reporting.