Infostealers are becoming the go-to phishing payload
Infostealers are quickly becoming the go-to phishing payload for cybercriminals, changing the landscape of cyber threats. In the past, traditional phishing relied mainly on tricking users into entering credentials on fake login pages. Now, attackers are using infostealer malware to quietly harvest passwords, browser data, session cookies and other sensitive information directly from infected devices.
What are infostealers and how do they work?
Infostealers are a type of malware designed to extract sensitive information from a victim’s computer without their knowledge. Unlike classic phishing techniques, which depend on the victim’s input, infostealers can harvest data already stored on devices. This includes saved logins, browser session tokens, autofill data, cryptocurrency wallet details and even files containing confidential information.
Why infostealers are more effective than traditional phishing
- Automation: Infostealers operate silently, automating the collection of valuable information from infected machines.
- Stealth: They avoid the obvious signs of phishing, such as suspicious links or fake login pages, making detection harder.
- Bypassing MFA: By stealing session cookies, attackers can bypass multi-factor authentication, accessing accounts without needing codes or passwords.
- Scalability: The rise of malware-as-a-service (MaaS) allows criminals to deploy infostealers at scale and with minimal technical expertise.
Infostealers often arrive via malvertising (malicious online ads), fake browser updates, cracked software, game cheats or dubious download sites. Once installed, they work in the background, collecting whatever information the device has in store.
Why infostealers matter to organisations
Infostealers represent a significant cyber threat because they undermine both technical and human defences. Traditional phishing relies on user awareness and vigilance, but infostealers bypass these protections by targeting stored data.
Key risks to business security
- Credential Theft: Harvested login credentials can be used for account takeover, fraud or business email compromise.
- Session Hijacking: Stolen session cookies allow attackers to impersonate users and bypass MFA, gaining access to corporate resources.
- Data Breaches: Sensitive files and browser data can be sold or used for further attacks, including ransomware or extortion.
- Supply Chain Attacks: Stolen information may be leveraged to attack partners or clients, increasing the risk to the wider business ecosystem.
- Persistent Threat: The MaaS ecosystem enables attackers to update infostealer code, rotate infrastructure and launch new campaigns easily.
Infostealers do not just affect large enterprises. Small and medium businesses (SMBs) are often targeted because they may lack robust security measures. A single infected machine can provide attackers with credentials, session data and access to sensitive internal systems, leading to multiple avenues for exploitation.
How organisations can defend against infostealers
Protecting against infostealer malware requires a layered approach, addressing both technical controls and user behaviour. Since infostealers frequently arrive through malvertising, fake updates and risky downloads, organisations should focus on hardening endpoints and improving user awareness.
Technical security measures
- Browser and endpoint hardening: Disable unnecessary browser extensions, restrict access to saved credentials, and enforce regular patching for operating systems and browsers.
- Restrict software sources: Limit the ability to install or run software to trusted sources only. Use application whitelisting and block downloads from unofficial sites.
- Strengthen web filtering: Implement robust web filtering solutions to block access to known malicious sites, ad networks and phishing domains.
- Phishing-resistant MFA: Adopt modern multi-factor authentication methods that are resistant to session cookie theft, such as hardware security keys or device-bound authentication.
- Rapid session revocation: Monitor for suspicious activity and enable quick session termination capabilities for high-risk accounts.
User education and awareness
- Training: Regularly educate users about the risks of malvertising, fake downloads and social engineering techniques.
- Safe browsing habits: Encourage staff to avoid clicking on sponsored ads, pop-ups or links from unknown sources. Always visit official websites directly.
- Suspicious activity reporting: Foster a culture where employees feel comfortable reporting unusual prompts, downloads or requests to IT teams.
Incident response and recovery
- Monitor endpoints: Use endpoint detection and response (EDR) tools to identify and isolate infected devices quickly.
- Session management: If an infostealer infection is suspected, revoke all active sessions and reset credentials to prevent further compromise.
- Data audit: Review logs, browser data and stored files for signs of unauthorised access or exfiltration.
Organisations should also keep abreast of emerging cyber threats by monitoring threat intelligence sources and updating incident response plans accordingly. Infostealers are likely to remain a persistent challenge as attackers continue to adapt their techniques.
Summary: Staying ahead of infostealer cyber threats
The shift towards infostealers as a go-to phishing payload marks a significant change in the threat landscape. By harvesting stored credentials, session cookies and sensitive data, infostealers bypass traditional security controls and exploit both technical and human vulnerabilities. Organisations must respond with a combination of technical defences, user education and rapid incident response to minimise risk.
Key actions include hardening browsers and endpoints, restricting software sources, strengthening web filtering, adopting phishing-resistant MFA and training staff to recognise and report suspicious activity. By proactively addressing these areas, organisations can reduce their exposure to infostealer-driven cyber threats and protect their valuable assets.
Originally reported by malwarebytes.com.
