Key points
- Lumma Stealer, StealC and RisePro are responsible for 75% of stolen credentials.
- Infostealers target browser cookies, VPN logins, MFA tokens and crypto wallets.
- Criminals sell this data on dark web markets to gain easy access to corporate systems.
The short version
- Infostealer malware has grown significantly over the past 18 months.
- These tools now account for three-quarters of all credential theft.
- Stolen data includes browser cookies, VPN credentials and MFA tokens.
The details
Organisations face a significant shift in how attackers gain initial access to their networks. According to cybersecurity vendor Immersive, infostealer malware is now responsible for 75% of all stolen credentials. This statistic covers the period of the past 18 months, during which these tools have experienced substantial growth. Specific malware families driving this trend include Lumma Stealer, StealC and RisePro. These programmes are designed to extract sensitive information directly from infected devices.
The data harvested by these infostealers is highly valuable to cybercriminals. The malware targets browser cookies, which can maintain active sessions without requiring passwords. It also captures VPN credentials, multi-factor authentication tokens and cryptocurrency wallet data. By stealing these items, attackers bypass traditional security controls. This allows them to impersonate legitimate users and move laterally within corporate environments.
The context
The commoditisation of initial access changes the landscape for both attackers and defenders. Ben McCarthy, lead cyber security engineer at Immersive, states that this shift enables nation-state goals through simple transactions rather than complex attacks. Cybercriminals sell the stolen data through dark web markets. This creates a ready supply of access credentials for other threat actors. The ease of acquiring valid credentials reduces the technical barrier for launching sophisticated intrusions.
Security professionals must adapt to this evolving threat model. The traditional dynamic between attackers and defenders has become fiercer. Fresh techniques are emerging while older approaches fall out of fashion. Advances in artificial intelligence and changes in computing infrastructures drive this rapid evolution. Continuous education is required to defend against these increasingly sophisticated threats.
Defender's checklist
- Monitor for unusual login activity, especially from new locations or devices.
- Implement strict controls on browser data access and session management.
- Use hardware-backed authentication to protect MFA tokens from theft.
- Regularly audit third-party integrations and development toolchains.
If your data is involved
If you suspect your credentials have been compromised via infostealer malware, treat the situation with urgency. Teams usually recommend resetting all passwords immediately, starting with critical accounts such as email and financial services. Check whether your browser sessions are still active and terminate them. Look for signs of follow-up scams, such as unexpected login alerts or requests for verification codes. Do not ignore these warnings, as attackers may attempt to use stolen tokens to maintain access.
What to do and how to stay safe: Lumma Stealer
- Rotate all passwords for accounts accessed on potentially infected devices.
- Revoke active browser sessions and clear cookies on affected machines.
- Monitor account activity for unauthorised logins or changes to security settings.
- Enable hardware-based multi-factor authentication to protect against token theft.
Step-by-step guide: EDR Misconceptions: Why Endpoint Detection Fails Without Context
General security guidance from the Cipher Insider newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which malware families are driving the increase in credential theft?
Lumma Stealer, StealC and RisePro are responsible for 75% of all stolen credentials.
What specific data do infostealers target?
They steal browser cookies, VPN credentials, MFA tokens and crypto wallet data.
How are attackers using the stolen credentials?
Cybercriminals sell the data on dark web markets to gain easy access to corporate systems.
