The Infostealer Ecosystem: Credential Theft and the Supply Chain of Compromise

The Infostealer Ecosystem

Ecosystem Architecture

The infostealer ecosystem operates as a multi-layered supply chain with distinct roles and economic relationships. At the top, malware developers create and maintain infostealer families, selling access through subscription-based malware-as-a-service (MaaS) models on underground forums and Telegram channels. Operators — who may range from individual cybercriminals to organized groups — deploy the malware through various distribution vectors: malvertising (malicious Google and Bing ads), SEO poisoning (fake software download sites), cracked software repositories, phishing campaigns, and YouTube tutorial videos containing malicious links.

Once deployed, infostealers execute on the victim's endpoint for seconds to minutes, harvesting stored browser credentials, autofill data, session cookies (including active MFA-authenticated sessions), cryptocurrency wallet files, VPN client configurations, FTP credentials, email client data, and system information (hardware ID, IP address, installed software). This harvested data is packaged into a "log" — a structured archive — and transmitted to command-and-control infrastructure where it is aggregated, sorted, and either used by the operator directly or sold through specialized marketplaces.

Major Infostealer Families

Lumma Stealer: The Current Market Leader

Lumma Stealer (also known as LummaC2) has emerged as the dominant infostealer by market share since mid-2024, surpassing RedLine and Raccoon. Written in C, Lumma offers sophisticated evasion capabilities including trigonometric-based anti-sandbox checks that analyze mouse cursor movements for human-like behavior, encrypted C2 communications using domain generation algorithms, and the ability to restore expired Google session cookies — allowing attackers to hijack Google accounts even after the victim's session has theoretically expired. Lumma operates through a tiered subscription model ($250-$1,000/month) with higher tiers offering additional features like custom build generation, residential proxy integration, and priority support.

The Raccoon Stealer Saga

Raccoon Stealer's trajectory illustrates the resilience of the MaaS ecosystem. After the arrest of Ukrainian national Mark Sokolovsky in March 2022 and the takedown of Raccoon v1 infrastructure, many anticipated the stealer's permanent demise. Instead, Raccoon v2 launched within months — rebuilt from the ground up in C/C++ with improved data collection capabilities, faster execution, and enhanced evasion. The v2 panel introduced a Telegram-based data delivery mechanism and an API for automated log processing, demonstrating the ecosystem's ability to rapidly reconstitute after law enforcement action.

Stealer Log Markets and Distribution

Market Infrastructure

Stolen credentials flow through several distinct market channels, each serving different buyer profiles:

Russian Market: The largest automated stealer log marketplace, operating as a searchable database where buyers can query by domain, URL pattern, or geographic location. Logs containing corporate credentials for specific organizations are priced between $5 and $50 per log, while logs containing financial institution credentials or cryptocurrency exchange access command premium prices of $50-$500. Russian Market processed an estimated 5 million new logs per month in 2024.

Genesis Market (successor operations): Although the original Genesis Market was seized by the FBI in April 2023, successor operations have emerged offering similar "bot" access — persistent browser fingerprints that allow buyers to impersonate the victim's browser session, bypassing device-based authentication and reducing detection risk.

Telegram channels: An increasingly significant distribution channel, with dedicated Telegram groups offering "cloud of logs" — bulk access to stealer log archives hosted on cloud storage. Free or low-cost channels distribute older logs (30+ days), while premium channels offer fresh logs (0-24 hours old) for $50-$200 per subscription. Dark Angel monitors over 340 Telegram channels distributing stealer log data.

From Stolen Credential to Enterprise Compromise

The Credential-to-Ransomware Pipeline

The supply chain from infostealer infection to enterprise compromise follows a well-established pattern that ransomware ecosystems have industrialized:

1. Endpoint infection — An employee's personal device, BYOD laptop, or home computer is infected with an infostealer through a malicious ad, fake software download, or phishing email. The infection may last only seconds, making endpoint detection challenging.
2. Credential harvesting — The stealer extracts stored browser passwords, including corporate email, VPN, and cloud service credentials that the employee has saved for convenience. Session cookies for active authenticated sessions are also captured.
3. Log aggregation and sale — The operator packages the harvested data and lists it on Russian Market, a Telegram channel, or sells it in bulk to an initial access broker (IAB).
4. IAB purchases and validates — An initial access broker purchases logs containing corporate credentials, validates them against the target organization's external-facing services (VPN, Citrix, Microsoft 365, Okta), and confirms the level of access obtainable.
5. Access sold to ransomware affiliate — The validated access is listed on RAMP, XSS, or Exploit forums, typically priced between $1,000 and $20,000 depending on the target organization's size, sector, and the level of access achieved.
6. Ransomware deployment — The affiliate uses the purchased access to establish a foothold, conduct reconnaissance, escalate privileges, exfiltrate data, and deploy ransomware.

Enterprise Exposure Assessment

Measuring Organizational Risk

Dark Angel's Exposure Intelligence module continuously monitors stealer log markets for corporate credential exposure. Key metrics that determine enterprise risk include the volume of exposed credentials associated with the organization's email domains, the recency of credential exposure (logs from the last 48 hours represent highest risk), whether exposed credentials include VPN, cloud admin, or privileged access accounts, the presence of valid session cookies that could bypass MFA, and whether exposed credentials have been observed in IAB listings or ransomware affiliate purchase patterns.

Analysis of Dark Angel's enterprise client base reveals that the average organization has 247 employee credentials appearing in stealer logs at any given time. Of these, approximately 34% represent active credentials that have not been rotated since exposure, 12% include VPN or remote access credentials, and 8% include cloud service administrator accounts.

Detection and Monitoring Strategies

External Monitoring

Effective infostealer risk management requires continuous monitoring of external credential exposure sources. Organizations should monitor stealer log marketplaces (Russian Market, 2easy, and successor Genesis operations) for credentials associated with corporate email domains, Telegram channels distributing stealer logs for corporate credential mentions, initial access broker forums for listings that may reference the organization, and paste sites and dark web forums for bulk credential dumps containing corporate data.

Internal Detection

On the endpoint and network side, indicators of infostealer compromise include anomalous browser data access patterns (rapid sequential reading of credential stores), unusual outbound data transfers from endpoints (stealer logs are typically 10-100MB), connections to known stealer C2 infrastructure, and authentication from unusual locations or devices following credential exposure. Session token reuse is particularly important to monitor — if a valid session cookie is stolen, the attacker can bypass MFA entirely, and the only detection opportunity may be simultaneous use of the session from geographically disparate locations.

Defensive Recommendations

1. Deploy continuous credential exposure monitoring — Implement automated monitoring for corporate credentials in stealer log markets, Telegram channels, and paste sites. Integrate exposure alerts with identity management systems for rapid credential rotation.
2. Enforce phishing-resistant MFA — Deploy FIDO2/WebAuthn hardware security keys or platform authenticators for critical systems. Traditional TOTP and push-based MFA can be bypassed through stolen session cookies.
3. Implement conditional access policies — Require device compliance checks, restrict access from unmanaged devices, enforce geographic access controls, and implement continuous session validation that detects token replay from anomalous locations.
4. Reduce browser credential storage — Deploy enterprise password managers and implement policies discouraging or technically preventing browser-based password storage. Educate employees about the risk of saving corporate credentials in personal browser profiles.
5. Monitor for session token abuse — Implement detection for concurrent session use from different locations, anomalous session duration patterns, and session cookie replay attempts. Consider implementing token binding where supported.
6. Conduct stealer log impact assessments — When corporate credentials are identified in stealer logs, investigate beyond simple password reset: assess what data the infected endpoint had access to, whether the compromised session was used for unauthorized access, and whether lateral movement occurred.
7. Address BYOD and personal device risk — Develop security policies for employees accessing corporate resources from personal devices, including MDM requirements, containerization, and prohibition of corporate credential storage on unmanaged endpoints.
8. Integrate with threat intelligence feeds — Ensure security operations teams receive timely intelligence on new infostealer variants, evolving distribution techniques, and changes in stealer log market dynamics.

Methodology

This report draws on Dark Angel's continuous monitoring of the infostealer ecosystem. Data sources include automated collection from stealer log marketplaces (Russian Market, 2easy, and Genesis Market successors), monitoring of 340+ Telegram channels distributing stealer logs and MaaS subscriptions, analysis of 26+ million stealer log entries processed in 2024, reverse engineering of major infostealer families, and incident response data from Dark Angel client engagements where stealer-sourced credentials enabled initial access. Malware family analysis is based on samples obtained from public and private malware repositories. Market pricing data reflects observed listings on multiple platforms across Q4 2024 and Q1 2025.

Related Reports

• The State of Ransomware 2025
• Dark Web Intelligence: OSINT Methodology for Enterprise Security
• Supply Chain Compromise: Third-Party Risk Intelligence