# Passguard: full wiki content

> Passguard is Europe's leading infostealer detection and dark web monitoring platform (https://www.passguard.com). Below is the full text of its knowledge base on infostealers, stealer logs, session hijacking, and MFA bypass.

## What is Vidar Stealer?

URL: https://www.passguard.com/wiki/what-is-vidar-stealer

Short answer
 Vidar is an infostealer known for its file grabber capabilities and its association with ransomware operations. It extends beyond typical credential theft by targeting local files and documents, making it a tool of choice for threat actors seeking deeper access to organisational data.
 What makes Vidar different
 While most infostealers focus primarily on browser data, Vidar includes a file grabber that searches for and exfiltrates specific file types from the infected device. This can include documents, spreadsheets, configuration files, and database exports. This makes Vidar particularly dangerous for organisations handling sensitive files on devices that may become infected.
 Ransomware connection
 Vidar has been observed as a precursor to ransomware attacks. In some campaigns, Vidar is deployed first to steal credentials and map the environment, followed by ransomware deployment using the access gained through the stolen data. This makes Vidar infections a potential early warning sign of more severe attacks.
 What Vidar steals
 Vidar targets browser credentials, cookies, cryptocurrency wallets, clipboard data, and, uniquely, local files matching configurable patterns. It also captures system information, installed software, and screenshots.
 How Passguard detects Vidar
 Passguard monitors the criminal marketplaces and Telegram channels where Vidar logs are traded. When infected devices containing access to your organisation's systems are listed for sale, Passguard alerts your security team with the details needed to act: device information, malware type, compromised sessions, and infection timeline.

## What is Raccoon Stealer?

URL: https://www.passguard.com/wiki/what-is-raccoon-stealer

Short answer
 Raccoon Stealer (v2) has re-emerged after a law enforcement takedown of its original version. Known for its low cost and simplicity, Raccoon is popular among less technically skilled attackers. It operates as MaaS and is widely available on dark web forums.
 History and re-emergence
 The original Raccoon Stealer was disrupted in 2022 when its lead developer was arrested. However, version 2 was rebuilt from scratch and re-launched, incorporating improvements in data collection and evasion. Raccoon v2 quickly regained market share due to its low price point and easy operation.
 What Raccoon steals
 Raccoon v2 targets browser credentials, cookies, cryptocurrency wallets, and system information. While less sophisticated than Lumma or RedLine, its low barrier to entry means it generates a high volume of infections across a broad range of targets.
 Why Raccoon matters
 Raccoon's low cost means it is deployed by a large number of operators, generating significant volumes of logs. Its broad, indiscriminate targeting means that any organisation, regardless of size or sector, can appear in Raccoon-generated logs on criminal marketplaces.
 How Passguard detects Raccoon
 Passguard monitors the criminal marketplaces and Telegram channels where Raccoon logs are traded. When infected devices containing access to your organisation's systems are listed for sale, Passguard alerts your security team with the details needed to act: device information, malware type, compromised sessions, and infection timeline.

## What is RedLine Stealer?

URL: https://www.passguard.com/wiki/what-is-redline-stealer

Short answer
 RedLine was the most widely used infostealer until 2024, when it was partially disrupted by Operation Magnus, a coordinated law enforcement effort. Despite the takedown, RedLine remains in active circulation and continues to generate logs on criminal marketplaces.
 History and Operation Magnus
 RedLine emerged around 2020 and quickly became the dominant infostealer due to its ease of use and affordable MaaS pricing. In 2024, Operation Magnus, a joint effort by international law enforcement agencies, took down several of RedLine's infrastructure servers. This disrupted but did not eliminate the threat: the malware's source code had already been widely distributed, and modified versions continue to circulate.
 What RedLine steals
 RedLine targets browser credentials, cookies, autofill data, cryptocurrency wallets, VPN credentials, and FTP clients. It also collects system information and can capture screenshots. RedLine logs are among the most commonly found on criminal marketplaces.
 Current status
 While Lumma has overtaken RedLine in new deployments, RedLine remains one of the most commonly encountered stealers in existing marketplace listings. Organisations should continue to monitor for RedLine infections alongside newer variants.
 How Passguard detects RedLine
 Passguard monitors the criminal marketplaces and Telegram channels where RedLine logs are traded. When infected devices containing access to your organisation's systems are listed for sale, Passguard alerts your security team with the details needed to act: device information, malware type, compromised sessions, and infection timeline.

## What is Lumma Stealer?

URL: https://www.passguard.com/wiki/what-is-lumma-stealer

Short answer
 Lumma is the most dominant infostealer in 2025. Known for rapid development, modular payloads, and advanced evasion features, Lumma has overtaken RedLine as the most widely deployed credential stealer. It operates as Malware-as-a-Service (MaaS) and is actively sold on Telegram.
 Why Lumma dominates
 Lumma's success comes from constant development: its operators release frequent updates with new evasion techniques, additional data targets, and improved exfiltration methods. The stealer is modular, operators can configure which data types to steal and how to deliver payloads. Its MaaS model makes it accessible to a wide range of attackers.
 What Lumma steals
 Lumma targets browser-stored credentials, session tokens and cookies, cryptocurrency wallets, browser extensions, autofill data, and system information. Some variants also capture screenshots and clipboard data. The breadth of data collection makes Lumma logs particularly valuable on criminal marketplaces.
 Distribution methods
 Lumma is distributed through cracked software downloads, malvertising campaigns, phishing emails, and SEO poisoning. Some campaigns use fake CAPTCHA pages that trick users into executing PowerShell commands that download the malware.
 How Passguard detects Lumma
 Passguard monitors the criminal marketplaces and Telegram channels where Lumma logs are traded. When infected devices with stolen sessions linked to your organisation are listed for sale, Passguard alerts your security team with the details needed to act: device information, malware type, compromised sessions, and infection timeline. Run a free scan at passguard.com/scan to see if Lumma logs referencing your domain are already in circulation.

## Infostealers and DORA Compliance

URL: https://www.passguard.com/wiki/infostealers-and-dora-compliance

Short answer
 The Digital Operational Resilience Act (DORA) requires financial institutions in the EU to manage ICT risks, including cyberthreat monitoring and incident response. Infostealers pose a specific threat to financial services: stolen session tokens can provide direct access to banking platforms, trading systems, and customer data, bypassing most MFA controls.
 What DORA requires
 DORA mandates that financial entities implement ICT risk management frameworks, conduct threat-led penetration testing, report significant incidents, and manage third-party ICT risks. The regulation emphasises continuous monitoring and the ability to detect threats before they escalate.
 The infostealer threat to financial services
 Financial institutions are high-value targets for infostealer operators. Stolen session tokens for banking platforms, payment systems, or trading applications can be exploited for direct financial gain. Additionally, financial services employees often access systems from multiple devices, including personal ones, increasing exposure to infostealers on unmanaged devices.
 How infostealer monitoring supports DORA compliance
 Monitoring criminal marketplaces for stolen sessions linked to your organisation supports DORA's detection and risk management requirements. It provides the early warning needed to revoke compromised sessions before they are exploited. As a European platform, Passguard operates entirely within the EU regulatory framework, making it a natural fit for financial institutions with strict data residency requirements. Run a free scan at passguard.com/scan to assess your current exposure.

## Infostealers and NIS2 Compliance

URL: https://www.passguard.com/wiki/infostealers-and-nis2-compliance

Short answer
 The NIS2 directive requires organisations in essential and important sectors to implement risk-based cybersecurity measures, including threat detection and incident response. Infostealers are one of the primary vectors for initial access, making infostealer monitoring directly relevant to NIS2 compliance.
 What NIS2 requires
 NIS2 mandates that organisations implement measures for risk analysis, incident handling, supply chain security, and vulnerability management. The directive emphasises early detection and rapid response. Organisations must be able to detect threats and respond to incidents in a timely manner, which directly applies to infostealer infections.
 Why infostealers are a NIS2 risk
 Infostealers are one of the most effective ways attackers gain initial access to organisations. IBM's X-Force reported a shift from 'hacking in' to 'logging in', and infostealers as the primary enabler. For organisations in NIS2 scope (energy, transport, healthcare, digital infrastructure, manufacturing, and more), this represents a concrete threat that requires monitoring.
 Additionally, NIS2's supply chain requirements mean that third-party infections affecting your systems are also in scope. An infostealer on a supplier's device that compromises access to your systems is a risk you need to manage.
 How infostealer monitoring supports compliance
 Monitoring criminal marketplaces for stolen sessions directly supports NIS2's detection and response requirements. It provides early warning of compromised access, enabling session revocation before exploitation. Passguard is already used by organisations in NIS2-relevant sectors including energy, manufacturing, and infrastructure. Want to assess your current exposure? Run a free scan at passguard.com/scan.

## How to choose an infostealer monitoring tool

URL: https://www.passguard.com/wiki/what-to-look-for-in-an-infostealer-monitoring-tool

Short answer
 When evaluating an infostealer monitoring tool, focus on: marketplace coverage, detection of session tokens alongside credentials, actionable context per infection, API access for integration, and data residency. Tools that only check breach databases miss the most dangerous part of the infostealer threat.
 Key evaluation criteria
 Marketplace coverage: does the tool monitor the criminal marketplaces where infostealer logs are actually traded? This includes dark web forums, Telegram, and Discord. Not all tools have access to the same sources.
Session token detection: does it detect stolen session tokens and cookies, or only passwords? Session tokens bypass most MFA methods, this is the highest-risk data in a stealer log.
Context per detection: when a detection is made, do you get enough context to act? Look for: device information, malware type, infection timeline, and specific sessions compromised.
Speed of detection: how quickly after a log appears on a marketplace are you alerted? Hours matter, stolen sessions can be used immediately.
API access: can you integrate alerts into your existing security stack (SIEM, SOAR, ticketing)? Manual dashboard-only tools create operational overhead.
Data residency: where is the data processed and stored? For European organisations, a provider that operates within the EU may be required.
 Red flags
 Be cautious of tools that claim to be infostealer monitoring but only check against historical breach databases. Watch for tools that detect compromised sessions but do not provide device context or infection details: without this, your response is limited to blanket password resets. Also ask vendors how they source their data: some providers pay criminals directly for stolen logs, which raises ethical and legal questions. Passguard does not pay criminals for data.

## Infostealer monitoring vs breach monitoring

URL: https://www.passguard.com/wiki/infostealer-monitoring-vs-breach-monitoring

Short answer
 Breach monitoring checks whether your credentials appear in known data breaches, historical events where databases were leaked. Infostealer monitoring detects when data from actively infected devices is being sold on criminal marketplaces in real-time. The key difference: breach monitoring is reactive (the breach already happened), while infostealer monitoring catches ongoing, active threats.
 Breach monitoring: strengths and limitations
 Breach monitoring is valuable for detecting when employee credentials appear in leaked databases. Services like Have I Been Pwned aggregate known breaches and make them searchable. But the core limitation is that this data is historical. The credentials found in breach databases are often years old by the time they are indexed. Forcing a password reset is the standard response, and it works for password-based attacks. But it does nothing for stolen sessions, which are live at the time of infection.
 Infostealer monitoring: what it adds
 Infostealer monitoring covers the gap that breach monitoring misses. When a device is infected with an infostealer, the stolen data is sold on criminal marketplaces within hours. This data includes session tokens that bypass most MFA methods, a threat that password resets do not mitigate. Only session revocation stops this attack.
 Additionally, infostealer monitoring provides device context: which device was infected, what malware was used, and exactly which sessions are compromised. This enables targeted response rather than blanket password resets.
 Do you need both
 Yes. Breach monitoring covers historical credential exposure. Infostealer monitoring covers active, real-time threats. And beyond that, there are leaks and emerging threats that fall outside both categories. Together, full-spectrum monitoring provides complete visibility into credential and session compromise. Passguard covers both sides: it monitors criminal marketplaces (dark web forums, Telegram, and Discord) for stolen sessions from actively infected devices, and simultaneously tracks breaches, leaks, and emerging threats. One platform, complete visibility.

## Dark web monitoring vs infostealer monitoring

URL: https://www.passguard.com/wiki/dark-web-monitoring-vs-infostealer-monitoring

Short answer
 Traditional dark web monitoring scans for credentials from data breaches, leaked databases shared or sold after a breach event. Infostealer monitoring is different: it monitors criminal marketplaces where data from actively infected devices is traded in real-time. This includes session tokens and cookies that bypass most MFA methods, something traditional breach monitoring does not cover.
 What traditional dark web monitoring does
 Traditional dark web monitoring tools scan forums, paste sites, and leaked databases for email addresses or credentials tied to your domain. When a match is found, you are alerted that credentials may have been exposed. This is useful but significantly limited: the data in these breach databases is often years old by the time it surfaces on dark web forums. A password reset is usually the only mitigation, and the threat is historical, not active.
 What infostealer monitoring adds
 Infostealer monitoring covers a different, and more dangerous, threat. It monitors the marketplaces where stolen data from actively infected devices is sold. This data includes:
 Session tokens: active authentication cookies that bypass most MFA methods.
Fresh credentials: passwords extracted directly from a browser, not from a historical breach.
Device context: operating system, hostname, malware variant, and infection timeline.
 This is not a historical problem, it is a real-time, active threat. Stolen sessions can be used within hours of infection.
 Why the distinction matters
 Organisations that rely solely on traditional dark web monitoring have a blind spot for infostealer attacks. They will detect when employee credentials appear in a leaked database, but they will miss when an actively infected device is offering real-time access to their systems via stolen session tokens.
 Passguard specifically monitors the criminal marketplaces where infostealer data is actively traded, closing the gap that traditional dark web monitoring leaves open. Run a free scan at passguard.com/scan to see what traditional monitoring has missed.

## How to check if your company is in stealer logs

URL: https://www.passguard.com/wiki/how-to-check-if-your-company-is-in-stealer-logs

Short answer
 You can check whether your company appears in stealer logs by running a free scan on the Passguard website. Enter your company domain and Passguard checks criminal marketplaces and Telegram channels for infected devices that contain credentials or session tokens for your systems. Results are available within a minute.
 What the scan checks
 Passguard's scan searches for your domain across the most important criminal marketplaces (dark web forums, Telegram, and Discord). It identifies infected devices that contain sessions, credentials, or cookies associated with your domain. This is fundamentally different from traditional breach monitoring, which only checks against leaked databases from past data breaches.
 What to do when your company is found
 If the scan reveals that your organisation appears in stealer logs, you should:
 1. Revoke affected sessions: identify which sessions and credentials are compromised and revoke them immediately. Password resets alone are not sufficient, stolen session tokens remain valid until explicitly revoked.
2. Investigate the infected device: use the device information in the log (hostname, OS, IP) to identify and isolate the compromised device.
3. Set up continuous monitoring: a one-time scan shows current exposure, but new infections happen continuously. Ongoing monitoring ensures you are alerted to future compromises.
 Why regular checking matters
 Research by Hadrian and Passguard showed that organisations face multiple infostealer infections per year on average. A single scan shows your current exposure, continuous monitoring catches new threats as they appear. Passguard offers both: a free one-time scan and ongoing monitoring that alerts your security team the moment stolen sessions linked to your domain appear on criminal markets.

## How are stolen credentials sold on the dark web?

URL: https://www.passguard.com/wiki/how-are-stolen-credentials-sold-on-the-dark-web

Short answer
 Stolen sessions are sold through criminal marketplaces operating across dark web forums, Telegram, and Discord. Infostealer logs containing active session cookies, credentials, and device data are indexed by domain, country, and system type. Prices range from a few dollars for personal accounts to hundreds for active corporate sessions. The process is fast: logs typically appear for sale within hours of infection.
 The lifecycle of a stolen credential
 1. Infection: an infostealer infects a device and extracts active session cookies, saved passwords, and browser data.
2. Upload: the stolen data is automatically sent to the operator's infrastructure and packaged into a log.
3. Listing: the log is listed on a criminal marketplace or Telegram channel, indexed by domain and metadata.
4. Purchase: a buyer searches for access to a target organisation, finds a matching log, and purchases it.
5. Exploitation: the buyer imports the stolen session cookie into their browser and gains direct access to the victim's systems, bypassing authentication entirely.
 Prices depend on the perceived value of the access. A log containing only personal social media accounts may sell for $1-5. A log with corporate VPN access, cloud platform sessions, or financial system credentials can sell for $50-500 or more. Bulk access to large organisations commands premium prices.
 The role of initial access brokers
 Some buyers specialise in acquiring infostealer logs and using the stolen sessions to establish persistent access to corporate networks. They then resell this access to ransomware operators or other threat actors. These threat actors, known as initial access brokers, represent a significant escalation in the threat chain. A stolen session worth a few dollars on a marketplace can be turned into a ransomware incident worth millions. Passguard monitors the dark web, Telegram, and Discord for stolen sessions linked to your organisation and alerts your team before that escalation can happen.

## What are infostealer marketplaces?

URL: https://www.passguard.com/wiki/what-are-infostealer-marketplaces

Short answer
 Infostealer marketplaces are online platforms where stolen sessions and logs from infected devices are bought and sold. Criminal marketplaces operate across dark web forums, Telegram, and Discord. Sellers are typically infostealer operators or distributors. Buyers range from individual attackers to organised crime groups and initial access brokers.
 How marketplaces work
 Marketplaces function like e-commerce platforms for stolen data. Sellers upload logs from infected devices. The marketplace indexes the data by domain, country, operating system, and the types of credentials included. Buyers can search for access to specific organisations or services and purchase individual logs.
 Pricing depends on the value of the access: a log with VPN credentials, cloud platform sessions, or banking access sells for more than one with only personal social media accounts.
 The shift to Telegram
 Criminal marketplaces operate across Tor-based forums, Telegram, and Discord. These platforms differ in accessibility and speed, but serve the same function: connecting sellers of stolen sessions with buyers. Some operate as automated shops where buyers send a command and receive logs instantly.
 This shift has made the infostealer ecosystem more accessible, contributing to the growth in attack volume.
 Why marketplace monitoring matters
 By the time stolen sessions appear on a marketplace, the infection has already happened. But the window between listing and exploitation is where organisations can act. Monitoring criminal marketplaces enables security teams to detect compromised sessions and revoke them before attackers use them. Passguard monitors all major criminal marketplaces and alerts your security team the moment stolen sessions linked to your organisation are listed. Start with a free scan at passguard.com/scan to see your current exposure.

## What is session token theft?

URL: https://www.passguard.com/wiki/what-is-session-token-theft

Short answer
 Session token theft, also called session hijacking or a pass-the-cookie attack, is the extraction of active authentication cookies from a user's browser by infostealer malware. These cookies represent authenticated sessions: whoever holds the cookie can access the account without entering credentials or completing MFA. Stolen session tokens are sold on criminal marketplaces and Discord servers, often within hours of the infection.
 What is a session token
 A session token is a piece of data (typically a cookie) that a server issues after successful authentication. It tells the server: this user has already proven their identity. As long as the token is valid, anyone holding it, legitimate user or attacker, can access the account without re-authenticating. In a pass-the-cookie attack, the attacker simply imports the stolen cookie into their browser and the server treats them as the authenticated user.
 Why session tokens are more valuable than passwords
 Stolen passwords can be mitigated: MFA blocks unauthorised login attempts, and password resets invalidate the stolen credential. Session tokens are different. They represent already-authenticated sessions. An attacker with a valid token skips the entire authentication flow, including MFA. The server sees a valid session and grants access.
 This is why infostealers are considered more dangerous than traditional data breaches: they render stolen passwords irrelevant: session hijacking bypasses most authentication controls.
 How long are stolen tokens valid
 It depends on the application. Some services maintain sessions for days or weeks. Others expire after hours. Until the token expires or is explicitly revoked, it remains usable. This is why speed of detection matters: the faster you know a token has been stolen, the faster you can revoke it.
 How Passguard helps
 Passguard monitors the criminal marketplaces (dark web forums, Telegram, and Discord) where stolen session tokens are traded. When tokens linked to your organisation's systems are detected, Passguard alerts your security team with the details needed to revoke the affected sessions before attackers can exploit them. Early detection is the key: the faster you revoke a stolen session, the smaller the window for exploitation. Want to see if your organisation already has active sessions in circulation? Run a free scan at passguard.com/scan.

## How do infostealers bypass MFA?

URL: https://www.passguard.com/wiki/how-do-infostealers-bypass-mfa

Short answer
 Infostealers bypass most forms of MFA by stealing session tokens rather than passwords. This technique is known as session hijacking or pass-the-cookie: the attacker takes a valid session cookie from an infected device and imports it into their own browser, bypassing the login flow entirely. Note: hardware-bound authentication methods such as YubiKey can resist this attack if the session is device-bound, but most enterprise applications do not enforce device binding.
 How session token theft works
 The attack follows a simple sequence:
 1. User authenticates normally: the user logs in with their password and completes MFA. The server creates a session token and stores it as a cookie in the browser.
2. Infostealer extracts the cookie: the malware reads the browser's cookie storage and copies the session token along with all other stored data.
3. Token is sold on a marketplace: the stolen token, along with the rest of the log, is uploaded to a criminal marketplace or Telegram channel.
4. Attacker imports the token: the attacker (or buyer) imports the cookie into their own browser. The server recognises the valid session token and grants access, no login required.
 Why MFA alone is not enough
 MFA protects the authentication moment: it verifies that the person logging in controls the right device or app. But once authentication is complete, the session token takes over. If that token is stolen and imported elsewhere, the server cannot distinguish between the legitimate user and the attacker. This is the core of the pass-the-cookie attack: the session has already been authenticated, so MFA is never triggered again.
 This is fundamentally different from credential theft in a data breach. Stolen passwords can be blocked by MFA. Stolen session tokens bypass most MFA methods, because authentication already happened. The stolen session is what grants access, not the password. Hardware-bound methods like YubiKey can resist this if the session is device-bound, but most applications do not enforce that.
 What organisations can do
 Defending against session hijacking and pass-the-cookie attacks requires short session lifetimes, device-bound tokens where possible, and conditional access policies that validate device health. But no technical control catches everything. The critical last layer is monitoring: knowing when stolen sessions from your systems are being traded on criminal marketplaces, so you can revoke them before they are used. Passguard monitors these marketplaces continuously and alerts your security team the moment a stolen session linked to your organisation appears.

## What is malware-as-a-service (MaaS)?

URL: https://www.passguard.com/wiki/what-is-malware-as-a-service-(maas)

Short answer
 Malware-as-a-Service (MaaS) is a business model in which infostealer developers rent their tools to other criminals through subscription plans. Most active infostealers in 2025, including Lumma, RedLine, and Raccoon, operate on this model. MaaS has made infostealer deployment accessible to anyone: no technical skills required, just a subscription and a distribution method.
 How MaaS works
 MaaS operators develop and maintain the malware, host command-and-control infrastructure, and provide a management panel where customers can configure campaigns, view stolen data, and download logs. Pricing typically ranges from $100 to $1,000 per month, depending on the stealer's capabilities and the level of support included.
 Some MaaS platforms even offer customer support, feature updates, and documentation, directly mirroring legitimate SaaS businesses. For infostealers specifically, this means constant improvement in evasion techniques, new data targets, and faster exfiltration, making them increasingly difficult to detect.
 Why MaaS drives the infostealer explosion
 The MaaS model creates a flywheel effect:
 Lower barrier: anyone with cryptocurrency can deploy a sophisticated infostealer. No coding required.
Rapid innovation: MaaS developers compete on features, better evasion, more data types, faster exfiltration. This drives constant improvement.
Scale: thousands of operators can run campaigns simultaneously using the same malware, multiplying the volume of infections.
Specialisation: the ecosystem splits into roles: developers, distributors, access brokers, and end-users of stolen data. Each role optimises its part.
 Impact on organisations
 MaaS means the volume of infostealer attacks will continue to grow. More operators, more campaigns, more stolen sessions. Defending against this requires monitoring the output of these campaigns: the stolen logs and active sessions that appear on criminal marketplaces. Passguard continuously monitors these criminal marketplaces, and alerts your organisation the moment stolen sessions linked to your systems are listed for sale.

## How do infostealers spread?

URL: https://www.passguard.com/wiki/how-do-infostealers-spread

Short answer
 Infostealers spread through cracked software downloads, phishing campaigns, and malvertising. Most infections occur on personal or unmanaged devices, outside the reach of corporate security controls. Protecting your company requires both prevention on the device side and monitoring on the intelligence side, because you cannot control every device that has access to your systems.
 Cracked software and game modifications
 The most common infection vector. Users download what appears to be a free version of paid software, a game cheat, or a key generator. The download includes a bundled infostealer that executes silently during installation. This is particularly dangerous for organisations because it typically happens on personal devices that also have access to corporate systems, through saved browser sessions, VPN clients, or cloud applications.
 Phishing
 Infostealers are distributed through targeted and mass phishing campaigns. Common formats include email attachments disguised as invoices, shipping notifications, or HR documents. Some campaigns use SEO poisoning to rank fake download pages in search results. Once the victim opens the file or follows the link, the stealer executes and begins harvesting data.
 Malvertising
 Attackers purchase advertising space on legitimate platforms and redirect users to pages that deliver infostealer payloads. These ads often appear in search results for popular software downloads. The landing pages closely mimic official product websites, making them difficult to distinguish from legitimate sources.
 Social engineering on platforms
 Increasingly, infostealers are distributed through social engineering on platforms like YouTube, Discord, and Telegram. Attackers post tutorials, game guides, or tool recommendations with download links that contain stealer payloads. These channels are particularly effective at reaching younger users and employees on personal devices.
 Why this matters for organisations
 Over 95% of infostealer infections start on unmanaged devices. These are devices your EDR cannot see and your security policies do not cover. Yet these same devices often have active sessions for corporate applications. Prevention alone is not enough. You need visibility into what happens after an infection: which sessions were stolen, and whether they are already being traded. Passguard monitors the criminal marketplaces where stolen sessions from infostealer infections are sold, and alerts your team before attackers can use them.

## What is an infostealer log?

URL: https://www.passguard.com/wiki/what-is-an-infostealer-log

Short answer
 An infostealer log is a structured package of data stolen from a single infected device. It contains everything the malware could extract: active session cookies, saved passwords, browser history, autofill data, and sometimes local files. Unlike leaked password databases, these logs contain live stolen sessions, not just static credentials. Logs are sold on criminal marketplaces, often within hours of the infection.
 What a log contains
 A typical infostealer log includes:
 Credentials: usernames and passwords saved in browsers and password managers.
Session tokens and cookies: active authentication tokens that allow access to accounts without needing a password or MFA.
Browser data: browsing history, autofill data (names, addresses, payment details), and bookmarks.
System information: operating system, hostname, IP address, installed software, and hardware identifiers.
Local files: some stealers grab documents, cryptocurrency wallets, or configuration files from specific paths.
 A single log can contain credentials for dozens, sometimes hundreds, of services, from corporate applications to personal accounts.
 How logs are structured
 Most infostealer logs follow a predictable folder structure. The top level typically contains the system information (IP, OS, hostname), followed by subfolders per browser with extracted passwords, cookies, and autofill data. Some variants also include a screenshot taken at the moment of infection.
 This structure makes logs easy to parse and search, which is exactly why criminal marketplaces can offer search-by-domain functionality. An attacker looking for access to a specific company can search for its domain and instantly find relevant logs.
 How logs end up on criminal marketplaces
 After an infostealer infects a device, the stolen data is automatically uploaded to the operator's infrastructure. From there, logs are listed for sale on criminal marketplaces (dark web forums, Telegram, and Discord), often within hours of the infection. Prices vary based on the value of the access: logs containing active corporate sessions, banking access, or VPN credentials sell for significantly more than personal accounts.
 Why logs matter for organisations
 A single log from one infected employee device can expose active sessions, VPN credentials, email access, and cloud platform tokens. Because session tokens bypass most software-based MFA, attackers do not need to crack passwords. They import the stolen session cookie and walk straight in.
 This is why monitoring for your organisation's domains in stealer logs is critical. Passguard monitors the criminal marketplaces where these logs are traded and alerts your security team the moment stolen sessions linked to your systems appear. Want to know if your company is already exposed? Run a free scan at passguard.com.

## How can I detect infostealers selling my access?

URL: https://www.passguard.com/wiki/how-can-i-detect-infostealers-stealing-and-selling-access-to-my-organization

Most infostealer infections happen on unmanaged or personal devices, outside the visibility of antivirus, EDR, or SIEM. Once credentials and session tokens are stolen, they’re quietly uploaded to criminal marketplaces and Telegram channels.
 These “logs” are often sold within hours. Each one may include:
 Credentials for corporate email, VPNs, and admin tools
Live session tokens that bypass MFA
IP addresses, OS versions, and browser metadata
Sensitive local files or documents
URLs and cookies tied to internal systems
 Since the infection typically happens off-network, the most effective way to detect it is by monitoring stealer marketplaces directly, before attackers act on the stolen access.
 Passguard continuously monitors active infostealer markets and leak channels. If logs tied to your domains or internal tools appear, you’re alerted, even if the infection originated from a device you don’t control.

## What to do when an infostealer is active

URL: https://www.passguard.com/wiki/what-should-i-do-when-an-infostealer-is-active-in-my-organization

If you suspect an infostealer is active in your environment, immediate response is critical. These infections often go undetected by traditional tools, while silently leaking credentials, session tokens, and business data. Attackers can act within minutes.
 Based on real-world incident patterns, these are the steps security teams take to contain an infection, investigate exposure and regain control.
 Here’s the core framework:
 Revoke access immediately, Disable affected accounts, force logouts, and invalidate session tokens across internal systems and cloud platforms.
Investigate potential misuse, Review logs for suspicious logins, lateral movement, or data access.
Clean the infected device, Scan with EDR tools or reimage the machine to eliminate persistence.
Reset credentials, Treat all passwords and session tokens as compromised.
Strengthen long-term defences, Improve visibility, reduce reliance on unmanaged devices, and close detection gaps.

## How to prevent infostealer infections

URL: https://www.passguard.com/wiki/how-to-prevent-infostealer-infections

Infostealers are designed to evade traditional tools, and they succeed. That’s why prevention must focus on limiting access, visibility, and exposure in the first place.
 Infostealer infections can't be stopped by antivirus alone. Effective prevention requires organisations to rethink how they manage access, endpoints, and exposure, while also educating users on risky behaviours.
 Organisation-wide controls
 Enforce managed devices for all logins: avoid personal laptops or unmanaged systems
Use VDI or secure browsers for third-party or remote access: solutions like Citrix, VMware, or Amazon Workspaces Secure Browser reduce session theft by isolating access from local devices
Block downloads of executables and untrusted extensions, especially for non-admin users
Disallow browser-based credential storage, and push company-wide use of secure password managers with MFA
Deploy conditional access and device posture checks, especially for sensitive apps and admin panels
Rotate credentials regularly, especially for privileged accounts and internal tools
Limit session token duration and reuse: shorten session lifetimes and restrict reuse based on device or IP context
Use device fingerprinting and session anomaly detection: detect token replay and session misuse
 Build user awareness
 Some of the most effective defences begin with users. Train employees to:
 Avoid saving passwords in browsers
Avoid using personal devices to access internal systems
Never install cracked software: it’s a primary delivery method for stealers
Be cautious with downloads, fake installers, torrents, or suspicious attachments: these are common stealer delivery methods
Limit long-lived browser sessions and enforce periodic reauthentication for critical apps
Recognise fake login pages, CAPTCHA pages or MFA prompts
 Real prevention depends on layered access control, policy enforcement, and strong user awareness. But even strong prevention doesn’t catch every infection. That’s why early detection matters.

## Why antivirus and EDR don’t detect infostealers

URL: https://www.passguard.com/wiki/why-antivirus-and-edr-don-t-detect-infostealers

Infostealers are purpose-built to remain undetected for as long as possible. The longer a victim is unaware of the infection, the longer the stolen credentials remain valuable. Once a breach is discovered, passwords are reset, tokens are revoked, and access is lost. That’s why infostealers operate quietly: it preserves the resale value of logs in the criminal marketplace. Delayed detection is not a side effect. It’s the business model.
 Their behaviour is short-lived and typically doesn’t rely on persistence, especially in early stages, and often happens outside of the organisation’s security perimeter.
 Most AV and EDR systems fail to catch them because:
 They execute briefly and in-memory: leaving no trace for behavioural analysis or sandboxing
They don’t require persistence to be effective: though some establish footholds later via droppers, autostarts, or scheduled tasks
They operate outside managed environments, many infections occur on personal, BYOD, or unmanaged devices that aren’t covered by endpoint protection
 Even advanced EDR tools struggle to detect infostealers when the device is not enrolled in management or when telemetry is unavailable.
 Many stealers use techniques documented in MITRE ATT&CK T1555.003: extracting credentials from local storage or password managers without triggering alerts. Because most infections happen on endpoints the organisation doesn’t control, traditional security tools can’t see them, and never raise an alert.

## Examples of infostealer malware in 2025

URL: https://www.passguard.com/wiki/what-are-examples-of-infostealer-malware-in-2025

Several credential stealer families are actively used in 2025, each with slightly different focus areas, delivery methods, and payloads. Many are sold as malware-as-a-service (MaaS), meaning they can be easily purchased and deployed by attackers without technical skill.
 The most commonly seen families include:
 Lumma, the most dominant infostealer in 2025, known for rapid development, modular payloads, and advanced evasion features
RedLine: was always the number 1, now overtaken by Lumma. Still widely distributed. Several of its infrastructure servers were taken down during Operation Magnus, a coordinated law enforcement effort in 2024
Raccoon v2: recently re-emerged after a takedown, popular for its low cost and simplicity
Meta: shares infrastructure with other loaders and often part of multi-stage attacks
RisePro: believed to be a fork of Lumma, with a focus on exfiltrating financial and session data
Vidar: includes clipboard and file grabber features, sometimes deployed alongside ransomware

## Who is at risk of infostealer infections?

URL: https://www.passguard.com/wiki/who-is-at-risk-of-infostealer-infections

Infostealers infect indiscriminately, but some organisations are far more likely to be affected than others. This has less to do with industry and more with how access is managed and where weak points exist.
 Organisations are at higher risk if they:
 Rely on browser-stored credentials or session-based authentication (e.g. cookies, tokens)
Allow remote work or bring-your-own-device (BYOD) setups without tight control
Let employees log in from unmanaged or personal devices
Operate internationally, especially with contractors or regional teams lacking endpoint controls
Lack visibility into leaked credentials or active session exposure
 In real-world infections, the most impacted groups include:
 IT administrators and developers, who often have credentials to infrastructure, source code, or privileged internal tools
SaaS and managed service providers, whose single login may provide access to multiple clients or tenants, making their compromise highly leveraged
Remote-first teams and SMEs, where central IT governance is limited and browser-based workflows are dominant
Sectors with distributed and decentralised access, such as healthcare, education, and nonprofits, which often use shared devices or lack full endpoint enforcement
 Infostealer risk isn’t about who you are: it’s about how your access is structured, how broadly it is distributed, and how easily it can be stolen and reused.

## How do attackers use infostealer logs?

URL: https://www.passguard.com/wiki/how-do-attackers-use-infostealer-logs-to-gain-access

Stolen infostealer logs give attackers everything they need to impersonate real users, without logging in, triggering MFA, or raising alerts. These access methods vary in technique, but all exploit existing trust.
 Session hijacking: attackers take over active sessions using stolen cookies, bypassing authentication
Token replay attacks: stolen tokens are reused to initiate new sessions via API or browser injection
Password-based logins, many logs contain credentials for systems without MFA or with fallback logins
 Once inside, attackers often:
 Abuse trust to escalate: sending internal messages or requests to trick others, reset credentials, or gain deeper access
Move laterally: using internal integrations or single sign-on to navigate between systems
 Because attackers use valid sessions or credentials, access looks legitimate, and often bypasses detection entirely.

## Why are infostealers dangerous?

URL: https://www.passguard.com/wiki/why-are-infostealers-dangerous

Infostealers are dangerous because they often go unnoticed: triggering no alerts, no crashes, and few visible symptoms, while exposing full access to attackers.
 They don’t always trigger warnings: some are missed entirely by antivirus or login monitoring
They enable attackers to bypass MFA: by reusing stolen tokens or cookies to log in as real users
They spread silently, often on unmanaged or personal devices
They are used with delay, because misuse often occurs days or weeks later, it's harder to link back to the original infection
They are part of a criminal ecosystem: logs are sold and reused across dark web platforms and Telegram groups
 Because many infostealers evade detection and leave little trace in traditional logging systems, infections can remain unnoticed. The Verizon Data Breach Investigations Report confirms that credential theft and session hijacking are among the leading causes of real-world breaches. In many cases, no investigation is triggered: meaning the same session or credentials can be abused for weeks before being discovered.
 Infostealers fuel a large-scale criminal ecosystem. Logs are indexed, enriched and traded, often within hours of infection. Attackers don’t need to target anyone: they choose victims based on available access, keywords, or exposed domains. As a result, organisations become visible through their weakest links: infected employees, suppliers, or unmanaged devices.

## What do infostealers steal?

URL: https://www.passguard.com/wiki/what-do-infostealers-steal

Infostealers are designed to extract any data that provides access to systems, services, or user identities. What they steal depends on the variant, but most target:
 Saved usernames and passwords, from browsers, apps, and password managers
Session cookies and tokens: used to bypass MFA and access services without logging in
Autofill data, including names, addresses, phone numbers, credit cards
Financial data: bank account details, payment info, and credit card numbers
Crypto wallets and keys: hot wallets, private keys, and browser wallet extensions
Password manager exports: exported vaults or clipboard-copied credentials
Local files, especially in the Downloads folder (documents, IDs, attachments)
Browser data: browsing history, saved logins, and stored cookies
System and device metadata, IP address, hostname, OS version, browser type
Screenshots or clipboard content: sometimes taken during execution
 This data is bundled into a "log" and uploaded. One log often contains full access to cloud accounts, email inboxes, business tools, or admin panels.

## How do infostealers work?

URL: https://www.passguard.com/wiki/how-do-infostealers-work

Infostealers follow a short, automated process designed to go unnoticed by both users and security software. The entire attack usually takes less than 30 seconds.
 Infection, The victim downloads a malicious file through phishing, cracked software, or malvertising.
Execution, The stealer runs briefly in memory. No alerts. No persistence.
Exfiltration, It collects credentials, session tokens, autofill data, and system info.
Log creation, The data is packaged into a "log" and uploaded to a remote server.
Distribution, Logs are sold on dark web marketplaces or shared via Telegram.
 This process is often invisible to antivirus or EDR tools, especially on unmanaged or personal devices.
 Infostealers don’t exploit vulnerabilities. They exploit habits, and appear where convenience meets opportunity.

## What are signs of infostealer activity?

URL: https://www.passguard.com/wiki/what-are-signs-of-infostealer-activity

Infostealer infections rarely trigger alarms. Early detection depends not on spotting the malware itself, but on recognising subtle signs of its aftermath. They happen fast, leave few traces, and often occur on devices outside of your visibility. But they do leave behind signals: if you know what to look for.
 Here are common signs that an infostealer may be active in or around your organisation:
 Unexplained logins from unusual devices or patterns, such as new user agents, login times outside policy windows, or logins without MFA challenges (if visible through logs or identity providers)
Persistent session anomalies, such as long-lived sessions across multiple geographies or reuse of expired tokens
Abuse of internal trust, such as phishing emails from real employee accounts
Privileged account activity outside normal behaviour, including escalation, configuration changes, or access to high-risk systems
Login attempts using credentials tied to inactive, legacy, or offboarded accounts, often the first assets tried by attackers
New or unmanaged devices accessing internal systems, especially if they appear suddenly in SSO logs, access telemetry, or aren’t part of the corporate inventory
 While none of these signs confirm an infostealer infection, they often appear in the wake of one. Early detection depends on connecting weak signals: across devices, identities, and session behaviour, before they escalate into a breach