Follow the Access · 09 — The Infostealer: The Malware That Empties the Whole Wallet

Follow the Access — Case 09. This register follows the intruder from the login prompt to the foothold's fate, and closes each case on what the access becomes: RANSOMED · MINED · PROXIED · HARVESTED · WIPED · RESOLD.

Case 04 followed the phish, which deceives a person into typing one credential into a counterfeit page. This case follows a colder, more complete thief. The infostealer does not deceive anyone into handing over a single password; it runs on the victim's own computer and carries out everything of value stored there — every saved password, every logged-in session, every autofill record, every cryptocurrency wallet — in one silent sweep, and then leaves. Where the phish picks one pocket, the infostealer empties the whole house. It is the difference between a con artist who talks you out of your wallet and a burglar who walks through your home while you sleep and takes every valuable in it.

The reason the infostealer is so devastating is that the modern personal computer is a warehouse of secrets, and most people do not think of it that way. Over years of use, a browser accumulates hundreds of saved passwords, live session cookies for every account the user stays logged into, autofill data with names and addresses and card numbers; a crypto user keeps wallet files; a professional keeps VPN and email and messaging credentials. All of it sits on the machine, stored for convenience, protected only by the assumption that no hostile program will ever run there. The infostealer is the hostile program that runs there, and when it does, it does not pick and choose. It takes the warehouse.

So the disposition is HARVESTED, and it is HARVESTED in bulk — not one identity but an entire digital life, packaged into a file the criminals call a "stealer log" and sold on markets that trade these logs by the millions. This is the case about the malware that empties the whole wallet, and about the enormous, quiet economy built on selling the contents.

1. The Warehouse and the Sweep

Begin with what the infostealer actually takes, because the breadth of the harvest is the whole point and it is larger than most victims imagine. When a stealer executes on a machine, it works through a checklist of every place secrets are commonly stored, and it is thorough. It reads the saved-password databases of every installed browser — Chrome, Firefox, Edge, and the rest — decrypting the credentials the browser stored for the user's convenience. It copies the session cookies, the tokens that keep the user logged in to their email, their bank, their work systems. It grabs autofill data: names, addresses, phone numbers, and in many cases payment-card details. It hunts for cryptocurrency wallet files and the browser extensions that hold them. It collects credentials from messaging apps, VPN clients, email clients, and FTP tools. It often takes a screenshot and an inventory of the machine. And then it bundles all of it and sends it to the attacker, typically in seconds, and typically without the victim noticing anything at all.

The completeness is what separates this vector from the credential attacks before it. The brute force of Case 02 might crack one weak password; the phish of Case 04 might capture one login the victim was tricked into typing. The infostealer takes everything, indiscriminately, because it does not need to guess or persuade — it simply reads the storage where the victim, or the victim's software, already saved it all in plaintext-recoverable form. Every convenience the user ever accepted — "save this password?", "keep me logged in", "remember my card" — becomes, in the instant the stealer runs, an item on the manifest of what is carried out. The machine's own helpfulness is the thief's inventory.

And the sweep is a single event, not a campaign. The infostealer is usually not persistent; it does not need to be. It runs once, harvests the warehouse, exfiltrates the loot, and often deletes itself, its entire job done in the moment of the sweep. This is why victims so rarely detect it: there is no ongoing suspicious activity to notice, no slow drain to alarm anyone, just one brief execution that took everything and vanished. By the time any consequence appears — a drained wallet, a hijacked account, a breached employer — the stealer is long gone and the harvest is already for sale. The theft and the departure are the same instant, which is exactly what makes it so hard to see and so complete when it lands.

2. A Mass-Market Product, Delivered in Ordinary Life

Now the scale, because the infostealer is not an elite weapon deployed against chosen targets — it is a cheap, mass-market product that infects vast numbers of ordinary people, and understanding its commercial nature explains its enormous reach. Infostealers are sold as malware-as-a-service: families like RedLine, Raccoon, Lumma, and Vidar are rented to affiliates for a modest monthly fee, complete with a control panel where the affiliate collects and browses the data harvested from everyone they have infected. The honeypot beneath these words has captured a cousin of this class directly — Remcos, a Windows remote-access tool used for the same keylogging and credential-theft ends — confirming that this endpoint-harvesting malware, not only the Linux miners of the earlier cases, reaches the sensor. The infostealer is a business, and like any business it optimizes for volume.

Volume comes from delivery through the mundane channels of everyday computing. The dominant path is not a sophisticated exploit but a willing download: pirated or cracked software, game cheats, unofficial "free" versions of paid tools, all bundled with a stealer so that the victim who wanted the free thing installs the thief alongside it. Fake download sites and malicious advertising impersonate legitimate software — the malvertising vector a later case will follow — so that a user searching for a real program downloads a poisoned one. Phishing attachments carry stealers; loader malware installs them as a second stage. In every case the victim is doing something ordinary and voluntary — installing a program they wanted — and the stealer rides in on that ordinary act. This is why the infostealer's harvest is so staggeringly large: it does not need to find valuable targets, because it infects everyone who cuts a corner, and everyone, sometimes, cuts a corner.

The result is an identity harvest of almost incomprehensible scale. Because each infection empties an entire machine, and because the malware infects by the millions through these everyday channels, the volume of credentials flowing into the criminal economy from infostealers is one of the largest single sources of compromised identity in existence. The person who downloaded a cracked video game at home, on the same laptop they use to log in to work, has — in that one careless moment — potentially handed over their bank, their email, their crypto, and their employer's VPN, all at once, to a criminal renting a stealer panel for the price of a dinner. The mass-market economics are the horror: the attack is cheap, the delivery is ordinary, the victims are everyone, and the harvest is everything they had saved.

3. HARVESTED — And the Cookie That Defeats MFA Again

Now the disposition, HARVESTED, and the infostealer earns it more completely than any vector so far, because it takes not one credential but the whole identity — and crucially, it takes the specific artifact that defeats the defense everyone was told to rely on. Recall from Case 04 that multi-factor authentication was supposed to make a stolen password useless, and that adversary-in-the-middle phishing beat it by stealing the live session cookie already past MFA. The infostealer does the same thing, but in bulk and without any counterfeit page.

Among everything the stealer sweeps from the browser are the session cookies — the tokens that represent an already-authenticated, already-past-MFA login. When the attacker imports a victim's stolen cookies into his own browser, he becomes the victim, logged in, without ever needing the password or the second factor, because the session was already authenticated when it was stolen. A stealer log therefore often contains not just passwords that MFA would blunt but live sessions that MFA cannot touch, for the victim's email, cloud storage, corporate single-sign-on, and more. The infostealer is, among its other functions, a bulk harvester of the exact identity artifact that renders multi-factor authentication moot — and it takes them not one at a time through an elaborate real-time proxy, as the phish must, but all at once, effortlessly, from the machine's own cookie storage. What the adversary-in-the-middle kit works hard to steal one session at a time, the infostealer scoops up by the fistful.

So the disposition is HARVESTED in its fullest form: the victim's entire authenticated identity, passwords and live sessions and wallets together, taken in one sweep and packaged for sale. The register marks it HARVESTED rather than any single downstream fate for the same reason it did with phishing — the harvest itself is the invariant, and what happens to each stolen credential afterward depends on who buys it. But the infostealer's harvest is broader and more complete than the phish's, because the phish takes what it tricks the user into typing while the stealer takes everything the machine ever stored. If phishing converts trust into a credential, the infostealer converts a single careless download into the wholesale surrender of a life.

4. Where the Log Goes — and How the Company Falls

Follow the harvest onward, because the stealer log is not a trophy but a commodity, and its journey through the criminal economy is where individual carelessness becomes organizational catastrophe. The moment the stealer exfiltrates its loot, that loot becomes a product: a structured log of everything taken from one victim, uploaded to the affiliate's panel and then sold. There are dedicated marketplaces and Telegram channels that trade stealer logs by the millions, and buyers browse them the way a shopper browses a catalogue, filtering for what they want. A log is priced by its contents: a random consumer's social-media logins are cheap; a log containing corporate credentials commands a premium; one holding a well-funded cryptocurrency wallet commands more. Nothing is wasted — even the least valuable log has some buyer, and the aggregate is an enormous, liquid market in stolen identity.

And here the register's through-line reasserts itself with particular force, because the infostealer is one of the most important on-ramps to the ransomware catastrophes of Case 03. Consider the chain. An employee uses a personal laptop, or a poorly managed work device, for both personal browsing and work — and on it, they have saved their corporate VPN credential, or stayed logged in to their company's single-sign-on. They download something they should not have, and a commodity stealer empties the machine, corporate credential and all. That credential lands in a stealer log, which an access broker (Case 02, Case 10) buys, recognizes as corporate access, and resells to a ransomware affiliate (Case 03), who uses it to walk into the organization as a legitimate user and begins the escalate-exfiltrate-encrypt campaign. A growing share of major breaches, when traced back to their true origin, begin not with a sophisticated attack on the company but with a commodity stealer on one employee's under-managed device — a cracked-software download at home that became, three transactions later, a seven-figure ransom at work.

This is the deepest reason the infostealer belongs high in the register despite being cheap and mundane: it is the vector that most efficiently converts the vast, ungoverned population of personal and under-managed devices into footholds against the organizations those devices' users work for. The company can harden every server it owns, and still be breached because an employee's home laptop — which the company does not control and cannot see — was emptied by a stealer that harvested a credential into the company's network. The infostealer erases the boundary between personal carelessness and corporate security, harvesting across it in a single sweep. The harvest is where many ransomware campaigns silently begin, one careless download at a time.

5. Defending a Machine That Betrays Itself

The register owes the defense, and here it is unusually broad, because the infostealer takes everything the endpoint stores, so the defense must span both the endpoint (to stop the theft) and the identity layer (to limit the damage when the theft succeeds). And it must begin with a hard admission: once a stealer runs, everything saved on that machine is already gone. There is no cleaning up a harvest; the loot left in seconds. So the defense is about preventing execution and about making the stolen credentials worth as little as possible.

On the endpoint side: run endpoint protection and, where possible, application control that blocks the stealer from executing in the first place, since prevention is the only real cure. Do not store passwords in the browser, which is the first and easiest place a stealer looks — use a dedicated password manager protected by a strong master secret that is not itself sitting in the browser's harvestable storage. And, decisively for the largest delivery channel, do not install pirated, cracked, or untrusted software, because that is how an enormous share of stealers arrive; the "free" version of the paid tool is very often the thief. On the identity side, the goal is to blunt what the stealer takes: phishing-resistant MFA raises the bar for stolen passwords, and — critically for the cookie problem — short session lifetimes and session binding limit the window in which a stolen cookie still works, so that a harvested session expires or fails rather than granting indefinite access. For organizations, the essential measure is to treat any appearance of an employee in a stealer-log dataset as a credential emergency: assume the harvested corporate credentials are already for sale, and reset them before a broker turns them into a breach.

The honest framing is that the infostealer exploits the accumulated convenience of modern computing — every saved password, every persistent session, every remembered card — and that the defense is partly a matter of accepting a little less convenience for a great deal more safety. A browser that saves nothing is a warehouse with nothing to steal; a session that expires quickly is a stolen cookie that soon dies; a machine that runs only trusted software is one the stealer never reaches. None of these is a single silver bullet, because the harvest is too broad for one control to cover, but together they shrink both the likelihood of infection and the value of what an infection yields. The infostealer's power comes from a machine that stored everything and trusted anything it ran; the defense is a machine that stores less and trusts less — and an organization that assumes its people's personal devices will, eventually, be emptied, and builds so that the emptying does not become its breach.

6. The counter-narrative, steelmanned

The strongest objection to this case is that the infostealer is a consumer-hygiene problem misfiled as an enterprise access vector — that it belongs in advice for individuals, not in a register of how serious adversaries breach serious targets.

The argument runs like this. Infostealers infect people who pirate software and click bad downloads; the fix is "don't do that," which is personal responsibility, not security architecture. Real organizations, the objection continues, manage their endpoints, forbid saved passwords, enforce MFA, and do not let employees run cracked games on machines that touch corporate systems — so the infostealer threat is a problem of undisciplined individuals and undisciplined shops, not a structural vector that well-run organizations must reckon with. And the market in stealer logs, however large, is mostly consumer junk: millions of logs of ordinary people's streaming and social accounts, a vast low-value harvest that says more about consumer carelessness than about any sophisticated threat. On this view the infostealer is real but misclassified — a hygiene failure inflated into an access vector.

The register concedes the hygiene dimension and rejects the misfiling. Yes, infostealers thrive on personal carelessness, and yes, much of the log market is low-value consumer data — the case says both plainly. But the objection assumes a boundary between personal and corporate devices that has largely dissolved, and that dissolution is exactly the point. The modern workforce blends personal and work computing constantly: employees check work email on home laptops, use personal devices under bring-your-own-device policies, save corporate credentials in personal browsers, and stay logged in to company systems on machines the company neither manages nor sees. The "well-run organization that manages every endpoint" is an ideal that the actual distributed, remote, BYOD workforce routinely departs from — and the infostealer is precisely the vector that exploits the gap, harvesting a corporate credential from a device outside the organization's control and delivering it into the organization's network. That is not a consumer problem that stops at the consumer; it is the mechanism by which consumer carelessness becomes corporate breach, documented repeatedly as the true origin of major ransomware incidents. And the "low-value junk" framing ignores that buyers filter: a market of millions of logs is valuable precisely because somewhere in the pile are the corporate credentials, and the buyers have tools to find them. The infostealer earns its place in the register not despite being a hygiene problem but because it is the vector that turns a hygiene problem, at scale, into the foothold that breaches the enterprise the careless user happens to work for.

7. Disposition — HARVESTED

Case 09 followed the infostealer — commodity malware that, once run on an endpoint, empties the whole credential warehouse in a single silent sweep: saved passwords, session cookies, autofill, crypto wallets, app credentials, everything the machine ever stored, taken at once and packaged for sale. It is not an elite weapon but a cheap mass-market product (RedLine, Raccoon, Lumma, Vidar, the honeypot-captured Remcos), delivered through the most ordinary channels of daily computing — pirated software, fake downloads, malvertising, phishing — so that it infects everyone who cuts a corner, which is nearly everyone, eventually. Where the phish picks one pocket, the stealer takes the house, and it takes the session cookies that are already past MFA, harvesting by the fistful the very artifact that defeats the second factor.

The disposition — the foothold's fate — is HARVESTED, in its fullest form: an entire authenticated identity, passwords and live sessions and wallets together, swept up and sold as a stealer log on markets that trade them by the millions, priced by what they contain. And the harvest is the raw material of the downstream register: a log holding a corporate VPN or SSO credential is bought by a broker and sold to a ransomware affiliate, and a growing share of major breaches begin exactly there — an employee's under-managed personal device, emptied by a commodity stealer, whose harvested corporate credential became the foothold. The infostealer erases the line between personal carelessness and corporate catastrophe.

The defense must span endpoint and identity because the harvest is total: block the stealer's execution, store passwords in a manager rather than the browser, avoid the pirated software that carries it, blunt stolen cookies with phishing-resistant MFA and short bound sessions, and — for organizations — treat any employee stealer-log appearance as a credential emergency, because the harvested keys are already for sale. The hard truth is that once the stealer runs, everything saved is already gone. The honeypot beneath these words caught the Windows side of this harvest in its Remcos capture: the same economy that mines Linux boxes empties Windows wallets. The vectors do not lie: a careless download ran a thief that read every secret the machine had saved, sent them all away in seconds, and vanished — and three transactions later, the credential it lifted from a home laptop opened the door to a company. We do not judge. We record. We let people judge — and then, if they are wise, store less, trust less, and assume the warehouse will one day be emptied.

Follow the Access continues. Case 09 disposition: HARVESTED. Confidence: HIGH — the commodity stealer families (RedLine, Raccoon, Lumma, Vidar) and the malware-as-a-service model are extensively documented in public threat reporting; the honeypot's own capture of Remcos corroborates credential-theft malware reaching the sensor; the stealer-log economy (marketplaces and Telegram channels trading logs by the millions) is well-documented; the session-cookie theft that defeats MFA is a named technique (MITRE T1539) and connects to Case 04; and the stealer-log-to-ransomware supply chain is a documented origin of major breaches, connecting to Cases 02, 03, and 10. Delivery via pirated software and malvertising connects to a later case. Classification: TLP:WHITE. Include everything — the vectors do not lie, and they do not judge. The reader judges the saved password, the persistent session, and the free download that was not free.