Threat Spotlight: Info-Stealers — How Your Passwords End Up for Sale

Behind a huge share of "mystery" account takeovers sits an unglamorous malware family: the info-stealer. Families like RedLine and its many successors do one job — land on a machine, harvest everything valuable in under a minute, and vanish. What they take: every password saved in the browser, session cookies, autofill data, crypto wallets, and a system fingerprint.

The supply chain of a stolen login

• Delivery: cracked software downloads, fake installers advertised in search results, malicious email attachments, game "mods".
• Harvest: seconds after execution, the "log" — a bundle of credentials and cookies — uploads to the operator.
• Market: logs are sold in bulk on criminal marketplaces for a few dollars each.
• Exploitation: buyers sort logs for business logins — Microsoft 365, banking, remote access — and either use them or resell to ransomware affiliates.

The nasty detail: session cookies

Stolen cookies can let an attacker resume an already-authenticated session — sometimes sailing past MFA entirely, because the login already happened on the victim’s machine. This is why a stealer infection is an incident, not an annoyance: assume every session and saved password on that device is burned, and revoke sessions as well as changing passwords.

Defences that map to reality

• Company password manager instead of browser-saved passwords — stealers raid the browser store first.
• Application control and sensible admin rights, so random downloaded executables don’t simply run.
• EDR on every machine — stealer behaviour is well-profiled and detectable.
• A culture where "I downloaded something dumb" is reported in minutes, so sessions get revoked before the log is even sold.

Info-stealers are the quiet engine of the cybercrime economy — the reason attacks so often start with a legitimate login rather than a break-in. Cut off the browser password store and you cut their profit margin directly.