An infostealer runs for 30 seconds and exits. It's not persistent. It doesn't beacon. It doesn't spread. By every traditional metric, it's a low-severity incident: one host, one execution, no C2, no lateral movement. The AV quarantined it. Ticket closed.

Except the attacker now has every credential that was on that machine: browser-saved passwords (all of them), session cookies (active logins to every web service), SSH private keys, cloud tokens, VPN credentials, Wi-Fi passwords, cryptocurrency wallet seeds, and every autofill field the user has ever populated. Those credentials are sold on dark web markets within hours. Buyers use them for BEC, ransomware initial access, account takeover, and corporate network intrusion.

The infostealer itself is trivial. The credential blast radius is the actual incident.

Raccoon Stealer: MaaS (Malware-as-a-Service). Steals browser credentials, cookies, crypto wallets, system info. Sold on Telegram. Active since 2019, v2 rebuilt in C/C++.
RedLine Stealer: Most widely deployed infostealer 2021-2024. Browser creds, FTP clients, VPN configs, Discord tokens, Steam sessions. Disrupted by law enforcement in late 2024 but variants persist.
Vidar: Forked from Arkei. Targets browser data, 2FA software databases (Authy, Google Authenticator exports), crypto wallets, and Telegram sessions.
Lumma Stealer: Rising post-RedLine disruption. Active MaaS with frequent updates. Browser targeting, crypto wallet injection, and clipboard hijacking.
META Stealer: Targets macOS specifically. Harvests Keychain credentials, browser data, and cryptocurrency wallets. Delivered via malicious DMG files.

1. 1. Identify the scope of harvested data Determine the infostealer family (AV detection name, hash, or behavioral analysis). Each family targets different data stores. At minimum assume: all browser-saved passwords, all active session cookies, all autofill data (addresses, credit cards, form fields), and system information (hostname, IP, installed software, screenshots). Higher-end stealers also grab: SSH keys, RDP credentials, VPN configs, cryptocurrency wallets, and messaging app sessions. HOST: T1555.003 Browser Creds · T1552.001 Creds in Files
2. 2. Enumerate every service the user had saved credentials for Export the browser's password manager (Chrome: chrome://settings/passwords, Firefox: about:logins) to identify every site/service with saved credentials. This is your blast radius map. Every entry is a compromised credential. Prioritize: corporate SSO/VPN, email, cloud services (AWS, Azure, GCP), financial accounts, code repositories (GitHub, GitLab), and anything with admin/privileged access.
3. 3. Revoke all active sessions, not just passwords For every service identified in step 2: reset the password AND revoke all active sessions/tokens. Stolen session cookies remain valid until the session is explicitly revoked, even after a password change. For cloud services: revoke OAuth tokens, API keys, and refresh tokens. For corporate services: force re-authentication on all sessions. Compromised Credentials playbook
4. 4. Check for SSH key compromise If the infected host had SSH keys (check ~/.ssh/ and any SSH agent forwarding), every server those keys authenticate to is now accessible. Enumerate: which servers trust these keys (check authorized_keys on all accessible hosts), whether SSH agent forwarding was in use (extends exposure to every hop), and whether the private key was passphrase-protected (infostealers grab the file, not the passphrase, but weak passphrases are crackable). HOST: T1552.004 SSH Keys · Linux Fleet playbook
5. 5. Check for cloud token and API key exposure Search the infected host for: AWS credentials (~/.aws/credentials, environment variables), Azure tokens (~/.azure/), GCP service account keys, and any .env files with API keys. Infostealers that grab files from common paths capture cloud credentials as a side effect. A stolen AWS access key is an open door to your cloud infrastructure.
6. 6. Check for VPN credential compromise If the user had VPN credentials saved (in a VPN client, browser, or credential manager), the attacker can authenticate to your corporate network from the outside. Check which VPN accounts are associated with the user, reset those credentials, and review VPN authentication logs for logins from unusual IPs after the infection timestamp. VPN authentication logs · Conditional Access: geographic/device filters
7. 7. Check for cryptocurrency wallet exposure Infostealers target wallet.dat files, browser extension wallets (MetaMask, Phantom), and seed phrase storage. If the user had cryptocurrency assets: check wallet balances immediately, transfer remaining funds to a new wallet with new keys, and assume any wallet the infected machine had access to is compromised.
8. 8. Determine the delivery mechanism How did the infostealer get on the host? Common vectors: cracked software downloads, fake game cheats/mods, phishing email with malicious attachment, SEO-poisoned download links, malicious ads (malvertising), and trojanized legitimate software. The delivery vector determines whether other users are at risk of the same infection. HOST: Execution · Sysmon EID 1 parent process chain
9. 9. Check dark web feeds for the stolen data Infostealer logs are sold on dark web marketplaces and Telegram channels within hours to days. If your organization uses a dark web monitoring service (SpyCloud, Flare, Hudson Rock, Have I Been Pwned), check for the user's corporate email and personal email in recent credential dumps. The log may show exactly what was taken.
10. 10. Assess whether the infected host was corporate or personal (BYOD) If the infection was on a personal device that accessed corporate resources (BYOD, home computer with VPN access, personal phone with corporate email), the blast radius extends to every corporate service the user accessed from that device. Corporate credentials on an unmanaged personal device are exposed credentials. This is increasingly common as infostealers target home computers that have corporate VPN/SSO saved in the browser.
11. 11. Check for follow-on access using stolen credentials After addressing the infostealer itself, hunt for evidence that stolen credentials have already been used. Pull authentication logs for every compromised account and check for: logins from new IPs, logins from unusual geolocations, logins at unusual times, and access to resources the user doesn't normally touch. The stolen credentials may have been sold and used before you detected the infostealer. Compromised Credentials playbook · BEC playbook

The fastest-growing infostealer vector is personal devices with corporate access. An employee's home computer has corporate VPN credentials saved in Chrome. Their kid downloads a cracked game. The game installs Raccoon Stealer. The infostealer grabs every browser password including the corporate VPN, SSO, and email credentials. The stolen log is sold on Telegram. A ransomware affiliate buys it and uses the VPN credentials to enter the corporate network.

This is not a theoretical scenario. It is documented in multiple IR engagements as a primary ransomware initial access vector. The corporate perimeter was not breached. The employee's home computer was, and it had the keys.

Compromised Credentials (what to do once you know credentials are in attacker hands)
Business Email Compromise (stolen email credentials are immediately weaponized for BEC)
Ransomware Detected (infostealers are the upstream supplier for ransomware initial access)
Lazarus (AppleJeus and Operation DreamJob function as targeted infostealers against developers)