What is an information stealer?¶
An information stealer is malware designed to collect valuable data from a device or user environment.
Avoid the dangerous assumption¶
The dangerous assumption is that an information stealer only steals passwords.
It may target:
- browser passwords
- session cookies
- authentication tokens
- cryptocurrency wallets
- payment information
- documents
- email data
- system information
- messaging sessions
- application credentials.
The stolen information may later support account takeover, fraud, extortion or resale.
Investigators should establish whether the malware was present, whether it executed and what data sources it attempted to access.
Evidence may include:
- process and file activity
- browser database access
- credential-store access
- archive creation
- network connections
- temporary files
- security detections
- data found on offender infrastructure
- later account compromise.
Do not assume that every item the malware was capable of collecting was actually obtained.
The device may not have contained the targeted data.
Security controls may have blocked access.
The malware may have failed before transmission.
Likewise, later account takeover does not automatically prove that the stealer caused it. Other credential-theft routes may exist.
Where possible, correlate the malware timeline with subsequent unauthorised sessions, password resets, token use or fraudulent activity.
Preserve browser profiles, relevant credential stores and endpoint records before remediation.
If the stealer created a temporary archive or staging area, preserve it before cleanup. The contents may show what was selected for theft even where transmission records are incomplete.
That staging evidence may be central to reconstruction.
Operational takeaway¶
Separate the information stealer’s capability, access to local data, successful collection and later misuse into distinct evidential stages.