Infostealer

Source: Wikipedia, the free encyclopedia.
Part of a series on
Computer hacking
History
Hacker culture and ethic
Conferences
Computer crime
Hacking tools
Practice sites
Malware
Computer security
Groups
Publications

In

cybercriminals
.

Infostealers usually consist of a bot framework that allows the attacker to configure the behaviour of the infostealer, and a management panel that takes the form of a server to which the infostealer sends data. Infostealers infiltrate devices through

pirated software
, among other methods. Once downloaded, the infostealers gather sensitive information about the user's device and send the data back to the server.

Infostealers are usually distributed under the malware-

spearphishing campaigns for other cyber-attacks, such as the deployment of ransomware
.

The number of stolen data logs being sold on the Russian Market, a cybercrime forum, has increased significantly since 2022. According to Kaspersky's research in mid-2023, 24% of malware offered as a service are infostealers. In February 2025, SparkCat, the first OCR infostealer, was discovered in the iOS App store.[1]

Overview

See also: Identity theft

In

command and control server, often known as the management panel or interface.[2]

The bot framework includes a builder that allows the attacker to configure how the infostealer will behave on a user's computer and what kind of information it will steal. The management interface, usually written in traditional

cloud infrastructure.[4] The management interface primarily functions as a web server to which the infostealer sends confidential information. The interface also provides the attacker with information about the status of deployed infostealers and allows the attacker to control their behaviour.[3]

Distribution and use

Infostealers are commonly distributed through the malware-as-a-service (MaaS) model, enabling individuals with varying technical knowledge to deploy these malicious programs. Under this model, three distinct groups typically emerge: developers, malware service providers, and operators. Developers, the most technically skilled, write the infostealer code. Malware service providers purchase licenses for the malware and offer it as a service to other cybercriminals. The operators, who can be developers or service providers themselves depending on their skill level, use these services to perform credential theft.[2]

Once the malware is purchased, it is spread to target victim machines using various

command-and-control servers, allowing the attacker to steal information from the user's computer. While most infostealers primarily target credentials, some also enable attackers to remotely introduce and execute other malware, such as ransomware, on the victim's computer.[2][6]

Credentials obtained from infostealer attacks are often distributed as logs or credential dumps, typically shared on paste sites like

zombie networks and reputation-boosting operations,[11] or as springboards for more sophisticated attacks such as scamming businesses, distributing ransomware, or conducting state-sponsored espionage.[7][12] Additionally, some cybercriminals use stolen credentials for social engineering attacks, impersonating the original owner to claim they have been a victim of a crime and soliciting money from the victim's contacts.[13][14] Many buyers of these stolen credentials take precautions to maintain access for longer periods, such as changing passwords and using Tor networks to obscure their locations, which helps avoid detection by services that might otherwise identify and shut down the stolen credentials.[13][14]

Features

An infostealer's primary function is to exfiltrate sensitive information about the victim to an attacker's

remote access trojans and ransomware.[3]

In 2009, researchers at the

POP3 and FTP protocols. In addition to this, the malware allowed the researchers to define a set of configuration files to specify a list of web injections to perform on a user's computer as well as another configuration file that controlled which web URLs the malware would monitor. Another configuration also allowed the researchers to define a set of rules that could be used to test if additional HTTP requests contained passwords or other sensitive information.[17]

More recently, in 2020, researchers at the

AZORult infostealer. Amongst the functions discovered by the researchers was a builder, which allowed operators to define what kind of data would be stolen. The researchers also found evidence of plugins that stole a user's browsing history, a customisable regex-based mechanism that allows the attacker to retrieve arbitrary files from a user's computer, a browser password extractor module, a module to extract Skype history, and a module to find and exfiltrate cryptocurrency wallet files.[15]

The researchers also found that the data most frequently stolen using the AZORult infostealers and sold on the black market could be broadly categorised into three main types: fingerprints, cookies, and resources. Fingerprints consisted of identifiers that were constructed by probing a variety of features made available by the browser. These were not tied to a specific service but were considered to be an accurately unique identifier for a user's browsers. Cookies allowed buyers to hijack a victim's browser session by injecting it into a browser environment. Resources refer to browser-related files found on a user's operating system, such as password storage files.[18]

Economics and impact

Setting up an infostealer operation has become increasingly accessible due to the proliferation of stealer-as-a-service enterprises, significantly lowering financial and technical barriers. This makes it feasible for even less sophisticated cybercriminals to engage in such activities.

command-and-control server. The primary ongoing cost incurred by these operators is the cost associated with hosting the servers. Based on these calculations, the researchers concluded that the stealer-as-a-service business model is extremely profitable, with many operators achieving profit margins of over 90% with revenues in the high thousands.[20]

Due to their extreme profitability and accessibility, the number of cybersecurity incidents that involve infostealers has risen.[7] The COVID-19 post-pandemic shift towards remote and hybrid work, where companies give employees access to enterprise services on their home machines, has also been cited as one of the reasons behind the increase in the effectiveness of infostealers.[7][21] In 2023, research by Secureworks discovered that the number of infostealer logs—data exfiltrated from each computer—being sold on the Russian market, the biggest underground market, increased from 2 million to 5 million logs from June 2022 to February 2023.[21] According to Kaspersky's research in mid-2023, 24% of malware offered as a service are infostealers.[22]

References

Citations

  1. ^ "SparkCat Malware Uses OCR to Extract Crypto Wallet Recovery Phrases from Images". The Hacker News. Retrieved 2025-03-22.
  2. ^ a b c Avgetidis et al. 2023, pp. 5308
  3. ^ a b c d e Avgetidis et al. 2023, pp. 5308–5309
  4. ^ Avgetidis et al. 2023, pp. 5314, 5319
  5. ^ a b Nurmi, Niemelä & Brumley 2023, p. 1
  6. ^ Ryan 2021, p. 76
  7. ^ a b c d Newman 2024
  8. ^ Nurmi, Niemelä & Brumley 2023, p. 2
  9. ^ Nurmi, Niemelä & Brumley 2023, p. 6
  10. ^ Nurmi, Niemelä & Brumley 2023, p. 7
  11. ^ a b Nurmi, Niemelä & Brumley 2023, p. 8
  12. ^ Muncaster 2023
  13. ^ a b Onaolapo, Mariconti & Stringhini 2016, p. 65,70,76
  14. ^ a b Bursztein et al. 2014, p. 353
  15. ^ a b Campobasso & Allodi 2020, pp. 1669
  16. ^ Grammatikakis et al. 2021, pp. 121
  17. ^ Nicolas & Chien 2009, pp. 3–4
  18. ^ Campobasso & Allodi 2020, pp. 1669–1670
  19. ^ Avgetidis et al. 2023, p. 5309
  20. ^ Avgetidis et al. 2023, p. 5318
  21. ^ a b Hendery 2023
  22. ^ Lyons 2024

Sources
Retrieved from "https://en.wikipedia.org/w/index.php?title=Infostealer&oldid=1281838532"