Executive Summary
Infostealer malware has become a dominant threat to corporate security, primarily by targeting unmanaged and 'crossover' devices—personal laptops or contractor systems used for both gaming/pirated downloads and work tasks. According to the 2025 Verizon DBIR, 46% of infected systems holding corporate logins were unmanaged, rendering traditional EDR insufficient. High-profile incidents, such as the Vercel/Context.ai breach, demonstrate that a single infection can lead to large-scale data theft by exfiltrating browser profiles containing saved passwords and active session cookies.
While law enforcement operations like Magnus and Endgame have temporarily disrupted infrastructure for families such as RedLine and Rhadamanthys, others like Lumma and Vidar 2.0 have shown remarkable resilience, rebuilding C2 infrastructure within weeks of takedowns. The threat has also expanded significantly into the macOS ecosystem with the rise of Atomic Stealer. The ultimate goal is the 'stealer log,' a package of credentials sold on the dark web that allows attackers to bypass Multi-Factor Authentication (MFA) by replaying active session tokens that have already cleared security prompts.
Organizations must shift from a purely device-centric defense to a session-centric model. This involves revoking active sessions immediately upon suspected infection, enforcing token binding, and governing browser extensions, which have emerged as a stealthy delivery mechanism that bypasses executable-based detection.