How infostealers work

Infostealers typically employ a botnet architecture. Under a malware-as-a-service model, attackers essentially rent or subscribe to infostealers, configure them as desired and then launch attacks against endpoint targets. Attack methods vary widely, ranging from phishing attacks and malicious links to social engineering and silent drive-by downloads.

Successful attacks infect user endpoints, which then become bots themselves, providing bad actors with command-and-control capabilities. Some infostealers do more than just steal data -- for example, installing additional malware.

Infostealers aren't new. Malware has been stealing data for decades … What is new is how easy it has become for anyone, regardless of skills, to use infostealers at scale.

Attackers primarily seek user credentials, including usernames, passwords and secret cryptographic keys. They might also look for crypto wallets, bank account information and other financial data. Other common targets include:

• Documents, spreadsheets and other files containing sensitive information.
• Web browser history, cookies and autofill values, such as saved passwords and credit card numbers.
• Technical information about the endpoint itself, its OS and its applications that can help attackers to plan future attacks.

How to respond to an attack

Infostealers aren't new. Malware has been stealing data for decades, and the methods infostealers use to infect endpoints, such as phishing and drive-by downloads, aren't new either. What is new is how easy it has become for anyone, regardless of skills, to use infostealers at scale. As a result, organizations are likely to face an increasing number of infostealer attacks.

Enterprise incident response plans and procedures should already address the gamut of infostealer attacks. However, considering their frequency and impact -- such as enabling access to admin accounts and decrypting and stealing sensitive information -- it is worth reviewing incident response programs with infostealers in mind. For example, investigate how the organization would respond to a widespread infostealer attack affecting many endpoints simultaneously. Adjust processes and priorities as needed to reflect the significance of infostealer attacks. And be sure to include infostealer scenarios in incident response tests and exercises.

How to detect and prevent infostealers

Detecting and preventing infostealers requires using all of the tools designed to safeguard your operations, including the following:

• Train users on cybersecurity basics, especially cyber hygiene and acceptable use.
• Use antimalware, antiphishing and antispam technologies on endpoints and on network-based devices to prevent infostealers from reaching endpoints and being installed.
• Keep all endpoints fully patched, properly configured and hardened to minimize their attack surfaces and their exploitable vulnerabilities.
• Continuously monitor all endpoints, email servers, networks and other associated systems for the presence of infostealers and infostealer command-and-control communications.
• Enforce the principle of least privilege.
• Use allowlisting/denylisting technologies on endpoints to restrict which applications can be executed.
• Constantly monitor endpoint logs and cybersecurity technology logs to identify signs of attempted and successful infostealer installation and use.
• Avoid using passwords only for credentials; instead, require MFA or other stronger authentication factors.
• Encrypt sensitive information at rest to make it more difficult for infostealers to access.
• Consider prohibiting the use of web browser autofill features, which could make it easier for infostealers to access passwords, financial account numbers and other sensitive data.

Karen Kent is the co-founder of Trusted Cyber Annex. She provides cybersecurity research and publication services to organizations and was formerly a senior computer scientist for NIST.