Infostealers aren’t going anywhere. They’re the quiet workhorses of the cybercrime economy, swiping passwords, cookies, and session tokens off devices every single day. And once that data is taken, it moves fast.
Microsoft’s Digital Crimes Unit, working with Europol and industry partners, announced a coordinated takedown on June 24 targeting the infrastructure behind two major players: StealC and Amadey. Over 200 malicious domains and C2 servers were shut down through court orders, domain seizures, and provider notifications.
StealC is a malware-as-a-service infostealer. Threat actors rent access to a builder, generate custom samples, and use a web panel to manage stolen data. It targets browsers, crypto wallets, messaging apps, email clients, gaming platforms — pretty much anything with saved credentials. Written in C++, it runs a language check and kills itself if the system locale is Russian, Ukrainian, Belarusian, Kazakh, or Uzbek. That’s a common tell.
To bypass Chromium’s App-Bound Encryption, StealC doesn’t bother decrypting inside its own process. Instead, it injects a payload into a suspended process and decrypts from there — then writes the results to a temp file. Clever, but not new.
Amadey is the delivery service. A MaaS loader that drops StealC, Lumma, or whatever payload the operator wants. It’s modular, pay-as-you-go. One initial infection can rapidly escalate into multiple threats.
Here’s the scary part: the initial infection usually happens on an unmanaged device. An employee’s home PC, a personal laptop, whatever. Corporate security doesn’t see it. The stolen credentials look legitimate when they’re used to access the corporate VPN. MFA? Doesn’t matter if they grabbed the session cookie too.
Stolen logs hit dark web markets within hours — as low as $2 per log on some Russian markets. Access brokers test them, validate them, resell them. Some ransomware groups deploy infostealers specifically to gather the credentials they need to get inside.
Microsoft used Copilot to help analyze the malware binaries, decrypt C2 configurations, and track the infrastructure. That’s a practical use of AI in defense — automating the grunt work of reverse engineering.
Bottom line: infostealer-driven intrusions are hard to spot until it’s too late. Identity protection, credential hygiene, and rapid response matter more than ever.
