Here is the scenario I see most often in incident response work: a business owner contacts me a week after discovering their Microsoft 365 account was accessed from an IP address in Eastern Europe. They had MFA enabled. They hadn't clicked anything suspicious. The password was unique. Nobody else had their credentials. And yet, someone logged in — and it worked.
The explanation, in almost every case, is an infostealer. Not a brute-force attack. Not a phishing page. A piece of malware that ran silently on one of their machines — for anywhere from a few minutes to a few weeks — harvested every stored credential, every active browser session, and every authentication cookie, then transmitted the entire package to a criminal marketplace before quietly self-destructing.
The session cookie is what matters. An authentication cookie is the proof your browser holds after you log in — the token your bank, your email provider, your Microsoft 365 tenancy uses to confirm "this is already authenticated, let them through." An infostealer that captures this cookie allows an attacker to replay it in their own browser and walk straight into your account as if they were already authenticated. MFA was satisfied when you logged in. The attacker doesn't need to satisfy it again. They just import the cookie and they're in.
What Infostealers Actually Take
The name "infostealer" undersells the scope. These are not tools that grab a password or two. A single execution on an infected machine produces a comprehensive dossier of everything the device has ever touched — typically packaged into a compressed archive and transmitted within seconds of infection.
Multi-factor authentication protects the login event. Once you've authenticated — once you've typed your password and approved the MFA prompt — your browser receives a session cookie that proves you're logged in. This cookie is what an infostealer steals. The attacker doesn't try to log in through the front door. They import your cookie and skip the login entirely. They are already inside. MFA was never asked. This is not a flaw in MFA — it is a fundamental characteristic of how web sessions work. The only defences against cookie theft are preventing the infostealer from running in the first place, and limiting session lifetime.
The Major Infostealer Families — Active in 2025–2026
The infostealer landscape operates as a mature, competitive software market. Developers maintain their malware, release updates, offer customer support to criminal subscribers, and compete on features and price. These are the dominant families currently active in the wild.
Lumma Stealer (also known as LummaC2) is currently the single most prolific infostealer in deployment globally, accounting for a significant share of all credential theft incidents in 2025. It operates as a Malware-as-a-Service — criminals subscribe to it on a tiered plan starting at around $250/month — and its developers maintain it actively, releasing updates that break security vendor signatures within days of detection.
Lumma's distinguishing capability is its advanced anti-analysis engine. It detects virtual machine environments and automated sandbox analysis, changing its behaviour to appear benign when it suspects it's being examined. It uses domain generation algorithms to create new C2 infrastructure continuously, making blocklists ineffective. Its most recent versions use legitimate cloud services — including Steam user profiles and Telegram channels — as C2 channels, making traffic indistinguishable from normal user behaviour.
Lumma targets 50+ browsers, all major cryptocurrency wallets, and specifically hunts for two-factor authenticator databases. If your team member has their 2FA TOTP seeds stored in a desktop authenticator app, Lumma will harvest those too — giving the attacker not just your current session cookie but the ability to generate valid future MFA codes.
RedLine is the most widely distributed infostealer by sheer volume of unique samples in circulation — a consequence of its low entry price (from around $100/month) and its years-long availability on criminal forums. It lacks Lumma's sophisticated evasion but compensates with ubiquity: it appears in phishing campaigns, malvertising, fake software downloads, and YouTube comment spam at a scale that other families cannot match.
RedLine is particularly prevalent in campaigns targeting gaming communities — fake cheat software, cracked game downloads, and "free V-Bucks" generators — which matters because those same machines are often also used for work. A staff member who installs cracked software on the same machine they use to access your practice management system or accounting platform has handed attackers access to both.
Vidar is a descendant of the Arkei stealer codebase and is particularly notable for its targeted file exfiltration capabilities. Beyond credentials and cookies, Vidar actively hunts for documents matching financial and professional patterns — tax documents, invoices, contracts, and password manager database files. For a professional practice this is acutely dangerous: Vidar specifically targets KeePass (.kdbx), LastPass, and 1Password vault files, as well as Bitwarden local exports. A stolen password manager database potentially yields hundreds of credentials in a single operation.
Vidar uses Telegram channels and Mastodon profiles as part of its C2 infrastructure — legitimate social platforms that most corporate firewalls will never block, making outbound communication invisible to most perimeter security tools.
StealC emerged in 2023 as a lightweight, modular alternative marketed explicitly on its small binary size and low detection rate. Its developers advertise it as "under 200KB" — small enough to be embedded in macros, email attachments, and drive-by download payloads without triggering size-based heuristics. It is modular: operators select only the data collection components they need, further reducing the malware's signature footprint.
StealC is heavily used in ClickFix campaigns — a 2024–2025 attack technique where users are tricked into running malicious PowerShell commands that they paste directly into their own Run dialog or terminal, believing they are fixing a technical problem on a webpage. No file is written to disk in the initial stage. The user executes the payload themselves. This technique completely bypasses execution prevention controls.
This group represents the newer generation of stealers: cross-platform capability is the defining feature. Atomic Stealer (AMOS) specifically targets macOS — a platform whose users have historically underestimated their exposure, often believing Macs don't get malware. Atomic targets macOS Keychain (where Safari, Mail, and system credentials are stored), Chrome and Firefox on macOS, and MetaMask and other crypto extensions on Safari.
Meduza Stealer targets Windows and focuses heavily on corporate credential theft — RDP credentials, VPN configs, and network-attached storage access — making it particularly dangerous for small businesses where one machine often holds credentials to everything else. Raccoon V2, the successor to the original Raccoon Stealer, rebuilt itself after its original developers were arrested in 2022 and is again active with an updated evasion engine.
How Infostealers Reach Your Machines
Infostealers don't compromise infrastructure — they compromise people. Every entry path exploits a human behaviour that is entirely normal and entirely reasonable in isolation.
The Stealer Log Ecosystem — Where Your Data Goes After Theft
An infostealer does not use your credentials directly. The criminal who deployed it sells them. This is the stealer log market — one of the most active segments of the cybercriminal economy — and understanding it matters because it explains why a compromise from months ago can result in an account takeover today.
The major platforms — Russian Market and 2easy.shop — operate with searchable catalogues. Buyers filter by domain, country, number of active cookies, and whether specific services are present. Your business's credentials appear in these searches. Buyers don't need to know who you are — they search for logs containing your practice management software domain, your accountant's platform, your Microsoft 365 tenancy — and your staff member's stolen log appears in the results.
The critical detail about session cookies: market listings include a freshness indicator. Cookies have expiry times. Buyers seek recent logs — logs where the authentication cookies haven't yet expired and can still be replayed to access the account. This is why the time between infection and account takeover can be as short as hours. The attacker buys a fresh log, imports the cookies, and they're in before your IT team has seen any alert.
Some logs are specifically marketed as "corporate access" — meaning they contain credentials and active sessions for internal business systems, not just consumer platforms. These command premium prices. A log with an active Microsoft 365 session for an account that has Global Administrator privileges in a small business tenancy can sell for hundreds of dollars because it gives the buyer direct access to the entire organisation's email, files, and user management — and from there, to ransomware deployment.
What Infection Actually Looks Like — Nothing
This is the part that makes infostealers so dangerous in a small business environment. There is typically nothing to notice. Here is what the infection sequence looks like from the infected user's perspective:
USER SEES: Nothing unusual. File downloads normally.
BACKGROUND: Stealer payload extracted from archive, loaded into memory via PowerShell
// T+00:04 — Execution begins
USER SEES: Installer appears to run. Progress bar. Software installs correctly.
BACKGROUND: Stealer enumerating browser profiles, wallet files, VPN configs, running processes
// T+00:18 — Data collection complete
USER SEES: "Installation complete." Software opens. Looks fine.
BACKGROUND: 254 passwords, 89 cookies, 3 crypto wallets compressed into 4.2MB archive
// T+00:31 — Exfiltration
USER SEES: Nothing. Minor network blip. Imperceptible.
BACKGROUND: Archive transmitted to attacker C2 via HTTPS (looks like normal web traffic)
// T+00:47 — Cleanup
USER SEES: Nothing. Machine operates completely normally thereafter.
BACKGROUND: Stealer deletes all traces. No process. No file. No registry entry. Gone.
// T+04:00 — Attacker imports session cookies
USER SEES: Nothing. Still no awareness anything happened.
BACKGROUND: Attacker browsing Microsoft 365 as the user, from a datacenter IP in the Netherlands
There are no error messages. No slowdown. No pop-ups. No unusual behaviour. The machine works perfectly. The user has no reason to suspect anything happened. Without active endpoint detection and response monitoring, this attack is completely invisible from the business side — sometimes for days or weeks, until an account shows anomalous login activity or the attacker takes an action that triggers an alert somewhere downstream.
Defence: What Actually Works Against Infostealers
Standard antivirus is not sufficient. Modern infostealers are specifically engineered to evade signature detection, run without writing files to disk, and execute and exit before heuristic engines can complete an analysis. This doesn't mean you're defenceless — it means the right controls are different from what most small businesses currently have.
The Uncomfortable Reality
Infostealers occupy an uncomfortable middle ground in the threat landscape: they're technically unsophisticated enough that commodity criminals run them at scale, but their attack technique — session cookie theft bypassing MFA — is sophisticated enough to defeat the control most businesses believe protects them. The result is that businesses with "good" security hygiene — unique passwords, MFA enabled on everything — still get compromised, because neither control addresses the actual attack vector.
The defences that work are behavioural EDR, session lifetime management, and making your machines inhospitable to unsigned code execution. These are not expensive. They are, however, more nuanced to configure than enabling MFA — which is probably why most small businesses haven't done them yet.
If you want to know whether your current endpoint configuration would catch an infostealer deployment, Greyhat4Hire can test it. We run controlled infostealer simulations as part of our endpoint security assessments — the kind that show you exactly how far a real stealer would get before anything triggered an alert. Usually the answer is instructive.