Every credential dump, every underground marketplace listing, every phishing campaign that feels personal starts with the same thing: a lightweight piece of malware sitting quietly on someone’s device, harvesting everything the browser has saved.
In January 2026, security researcher Jeremiah Fowler discovered an unprotected database containing 149 million unique login-password pairs, including 48 million Gmail accounts, 17 million Facebook accounts, and 900,000 Apple iCloud accounts. The database had not been assembled through a single breach or a targeted intrusion. It had been compiled entirely from infostealer logs, the output of malware that runs silently on infected machines, harvests saved passwords, browser cookies, autofill data, and authentication tokens, then transmits everything to an operator who packages it for sale on underground marketplaces.
That database was one collection among thousands. Flashpoint and DeepStrike both reported that more than 1.8 billion credentials were stolen in 2025, harvested from approximately 5.8 million infected devices, a figure DeepStrike described as an 800% surge over recent years. IBM’s 2026 X-Force summary found that one in three security incidents it investigated involved credential theft, with infostealers as the primary collection mechanism. The credentials feeding the dark web’s brand impersonation supply chain do not come from sophisticated intrusions. They come from malware that treats password collection as an industrial process.
How infostealers work
An infostealer is a category of malware designed to do one thing efficiently: extract stored credentials and session data from an infected device and transmit it to an attacker.
The targets are specific. Infostealers harvest saved passwords from web browsers, the autofill data that populates login forms, the cookies and session tokens that keep users logged into services between visits, cryptocurrency wallet files, and in some cases screenshots and keystrokes. The process is fast, typically completing in seconds, and usually invisible to the user. The malware runs, collects, transmits, and in many cases deletes itself, leaving no persistent presence that endpoint detection would flag after the fact.
The output is called a “log,” a structured package containing everything the malware extracted from a single device. A typical log includes dozens of saved credentials across email, banking, social media, corporate SaaS platforms, and cloud services, along with the cookies and tokens that allow an attacker to resume an active session without needing to authenticate at all. SpyCloud’s 2025 research found an average of 44 exposed credentials and 1,861 cookies harvested per infected device, which means a single infection yields not one compromised account but a comprehensive map of every service the victim uses.
The delivery mechanisms are deliberately ordinary. Infostealers arrive as trojanized software downloads, fake browser updates, cracked games and productivity tools, malicious ads that redirect to download pages, and phishing emails with attached files. Check Point reported that over 70% of infected devices were personal machines in bring-your-own-device environments, which means the infection often occurs on a device the employer does not control, using a network the security team does not monitor, and the stolen corporate credentials enter the underground economy without the organization ever knowing the device was compromised.
The families that dominate the market
The infostealer landscape operates as a competitive software market, with developers maintaining products, releasing updates, and servicing subscribers through the same malware-as-a-service model that powers phishing-as-a-service platforms.
RedLine Stealer, first identified in 2020, became what ESET described as the most prolific infostealer in history, responsible for 51% of all infostealer infections between 2020 and 2023 according to Kaspersky research. In October 2024, Operation Magnus, a joint operation by the Dutch National Police, the FBI, and partner agencies, disrupted RedLine’s infrastructure, seizing servers, domains, and Telegram channels. The disruption was significant but not permanent: Trend Micro observed hundreds of new command-and-control URLs appearing within weeks, and by late 2025 the malware had partially recovered, though at reduced volume.
Raccoon Stealer put a face on the MaaS model when its primary operator, Ukrainian national Mark Sokolovsky, was arrested in the Netherlands in March 2022 and subsequently extradited to the United States. The prosecution revealed the business mechanics: subscribers paid approximately $200 per month for access to the malware and its log-collection infrastructure, and the operation had accumulated more than 50 million stolen credentials before the arrest.
Vidar had a particularly strong run at the start of 2026, accounting for more than 73% of infected hosts tracked in January and February according to industry telemetry, filling the gap left by enforcement actions against other families. Stealc, a newer entrant, has grown rapidly by offering competitive pricing and a streamlined operator experience. The market reshuffles after every takedown, but the aggregate supply of stolen credentials has not meaningfully declined.
Why infostealers matter for brand protection
The connection between infostealer malware and brand impersonation is direct, even though the two problems are managed by different teams in most organizations.
The credentials that infostealers harvest become the raw material for targeted phishing campaigns. When an attacker purchases a log containing an employee’s saved credentials for a payroll portal, an HR platform, or a cloud email service, the resulting phishing lure can reference the specific service the victim actually uses, the specific employer they work for, and the specific login experience they expect. The lure feels personal because the data behind it is personal, extracted from the victim’s own browser by malware they never detected.
For the brands whose login pages are replicated in those downstream campaigns, the infostealer infection is the earliest event in a chain they typically only see at the end: the phishing page, the credential harvesting form, the customer complaint. Monitoring for stolen credentials tied to your organization on dark web marketplaces is the detection layer that operates at this stage, surfacing the exposure while the gap between theft and weaponization still provides time to act.
The same logs also enable the account takeover chains that lead to business email compromise, help desk impersonation, and lateral movement within vendor ecosystems. When infostealer output includes active session cookies for corporate SaaS platforms, the attacker does not need to phish anyone. They load the session into their own browser and arrive as a fully authenticated user. This is the same mechanism that adversary-in-the-middle phishing exploits at the point of authentication, except the infostealer collects the session token from the device rather than intercepting it in transit.
The Bottom Line
Infostealers are the first stage of the supply chain that produces brand impersonation campaigns, account takeover attacks, and business email compromise. They operate on personal devices the organization does not control, harvest credentials the user does not realize are exposed, and deliver that output to underground marketplaces where it is priced, packaged, and sold to operators who will use it to impersonate brands the victim already trusts. With 1.8 billion credentials stolen in 2025 and a competitive MaaS market that makes deployment accessible for as little as $130 per month, the infostealer threat is not a technical curiosity. It is the input that the rest of the criminal economy runs on.
Key Takeaways
A category of malware designed to harvest saved passwords, browser cookies, session tokens, autofill data, and cryptocurrency wallet files from infected devices. The output, called a “log,” is transmitted to an operator and sold on dark web marketplaces. A typical infection yields an average of 44 credentials and 1,861 cookies from a single device.
Flashpoint and DeepStrike reported 1.8 billion credentials stolen in 2025 from 5.8 million infected devices, an 800% increase over recent years. IBM found that one in three security incidents involved credential theft. Over 70% of infections occur on personal devices in BYOD environments.
RedLine was the most prolific infostealer from 2020-2023 (51% of infections) before its October 2024 disruption. Vidar accounted for 73% of infected hosts in early 2026. Stealc is a fast-growing newer entrant. The market reshuffles after each takedown but the aggregate credential supply has not declined.
Stolen credentials make downstream phishing campaigns personal and targeted. The attacker knows which services the victim uses, which employer they work for, and which login pages to replicate. For brands whose portals are impersonated, the infostealer infection is the earliest event in a chain that most organizations only see at the phishing page stage.
Monitor dark web marketplaces for stolen credentials tied to your organization and force password resets before those credentials are weaponized. Require phishing-resistant MFA to prevent stolen passwords from granting access. Recognize that over 70% of infections occur on unmanaged personal devices, meaning the compromise happens outside your security perimeter.
