Infostealers: key takeaways
- Identity is the new attack surface. Infostealers stole 1.8 billion credentials in H1 2025 and infected an estimated 23 million hosts in 2024, driving valid-account breaches and cloud compromise.
- Breaches start with logins. Approximately 30% of incidents involve identity-based attacks (IBM X-Force), and 16% of infections expose SSO / IdP credentials.
- They fuel ransomware. An estimated one-third of ransomware cases follow stealer infections; 54% of victims appeared in stealer log markets.
- Credential theft powers the ecosystem. Stolen logs sell for as little as $10, supplying ransomware operators and initial access brokers (IABs), who often deploy the stealers themselves or resell the access.
- Acronis enables resilience. Patch management, behavioral detection, clean restore and account-compromise monitoring stop and recover from stealer attacks.
What is an infostealer? Definition and core function
An infostealer is a malware family designed to harvest digital identity artifacts, including passwords, browser cookies, MFA tokens, cloud API keys and cryptocurrency wallets, rather than destroy or encrypt data. Infostealers act as first-stage payloads: They penetrate through phishing, SEO-poisoned downloads or malvertising, run stealthy collection routines, then exfiltrate the captured data to command-and-control servers.
Infostealers weaponize legitimate utilities (PowerShell, MSBuild) to operate filelessly and evade signature-based antivirus. Once the data is sold on underground marketplaces, ransomware operators use the stolen credentials to log into targeted environments, bypass MFA and execute extortion campaigns.
How do infostealers work? The infostealer attack lifecycle
Infostealers follow a structured attack lifecycle, from initial delivery through credential monetization. Each phase is designed to maximize data extraction while minimizing detection.
- Delivery, deception and SEO poisoning: Attackers use phishing emails, fake installers, malvertising and techniques such as "ClickFix" to convince users to run malicious downloads. They poison search results with counterfeit software sites and abuse Extended Validation certificates to appear legitimate.
- Execution, fileless evasion: Modern infostealers leverage living-off-the-land techniques, running via MSBuild or PowerShell and injecting into trusted processes to avoid dropping files on disk. Many infostealer families include anti-sandbox and anti-analysis checks to disable themselves in research environments.
- Harvesting, comprehensive data collection: Once active, the infostealer dumps browser-credential stores, cookies, session tokens, cryptocurrency wallets, API keys and even developer SSH keys. Some variants take screenshots or scan for specific cloud provider tokens to bypass MFA.
- Exfiltration, covert log extraction: Stolen data is exfiltrated via encrypted channels, including standard command-and-control (C2) servers and Telegram bots, then packaged into "logs" for sale on dark-web marketplaces.
- Monetization, log markets and IABs: logs are sold for as little as $10, depending on quality. Buyers include ransomware gangs and initial access brokers, who may use the valid credentials directly, resell them or deploy infostealers themselves to broker network access.
Infostealers by the numbers: key statistics (2024 to 2026)
Which infostealer families are most active? Major families (2023 to 2025)
How did infostealers enable the Snowflake breach? Case study (2024)
The Snowflake data breach stands as a cautionary tale of how infostealers enable mass data theft. From April to May 2024, the UNC5537 group breached over 160 Snowflake customer environments, targeting organizations such as AT&T, Ticketmaster, Santander Bank and Advance Auto Parts. The attackers didn't exploit a platform vulnerability; they used credentials stolen by infostealers, including RedLine, Lumma, Vidar and Raccoon, from employees and contractors. Because many accounts lacked MFA, adversaries logged into Snowflake via the web interface or CLI.
Once inside, they reportedly deployed a reconnaissance utility called FROSTBITE to map datasets and exfiltrate sensitive data, including 50 billion AT&T call records and 560 million Ticketmaster user records. The attackers demanded ransoms to prevent the sale of the stolen data, illustrating how long-lived stealer logs drive large-scale extortion.
How do infostealers lead to ransomware? The infostealer-ransomware nexus
Infostealers and ransomware are two sides of the same criminal coin. Nearly one-third of organizations that experienced a ransomware event had an infostealer infection in the preceding 16 weeks, and 54% of ransomware victims appeared in stealer log marketplaces before encryption. Attackers can skip vulnerability exploitation entirely and simply log in using stolen credentials, a shift reflected in the shrinking window between initial access and full compromise.
According to Mandiant M-Trends 2025, the global median dwell time fell to 11 days in 2024, and Verizon's 2025 Data Breach Investigations Report similarly highlights credential theft as a primary enabler of accelerated intrusions. Major ransomware groups, including Qilin, Akira, Cl0p and Play, consume stealer logs to procure VPN, RDP or MSP management access. This cheap access (logs cost $10 to $200) is then converted into multimillion-dollar ransom demands. To break this nexus, defenders must treat identity theft and ransomware preparation as a single attack continuum.
How do infostealers compromise cloud and SSO environments?
As businesses move to cloud and SaaS platforms, infostealers are shifting their focus to the "keys to the cloud kingdom." Instead of simple password lists, modern infostealer variants harvest session cookies and identity provider (IdP) tokens, enabling session hijacking and MFA bypass. In 2024, stolen cookies were the third most common entry point for ransomware. By late 2025, 16% of infostealer infections exposed credentials for SSO platforms like Okta, Azure and AWS, providing attackers with broad, persistent access. The table below summarizes common cloud targets and their potential impact.
Why are MSPs at higher risk from infostealers?
Managed service providers (MSPs) act as custodians for multiple client environments, making them lucrative targets for infostealer attacks. A joint advisory from CISA, the FBI, NSA and international cybersecurity agencies recommends that defenders prioritize MSP credential safety, recognizing that compromise of an MSP, particularly through reused privileged credentials, can enable access to multiple downstream customer networks and create cascading supply-chain effects (CISA et al., 2022). Identity recovery (invalidating all sessions after an incident), multitenant access auditing and proactive patching are essential to protect MSP environments and prevent cross-tenant lateral movement.
How does Acronis protect against infostealers?
Acronis combines proactive mitigation, real-time detection and resilient recovery to neutralize infostealer threats. The table below maps each phase of the infostealer lifecycle to the risk, the capability required to address it and the corresponding Acronis response.
Frequently asked questions about infostealers
How can organizations detect an infostealer infection early?
What are "stealer logs" and why are they dangerous?
Why is identity recovery critical after an infostealer incident?
Are infostealers only a Windows threat?
Why are MSPs high-value targets for infostealers?
Can MFA alone stop infostealers?
What makes infostealers different from traditional ransomware campaigns?
