All things infostealers. Week 37, 2025


A brief look at all things infostealers for the week 37, 2025 (08.09.2025–14.09.2025). Grabbed some numbers from marketplaces and some interesting news/articles.

Infostealer Updates

¯\_(ツ)_/¯


Marketplace Updates

This section provides some numbers taken from the marketplaces, which include numbers of victims based on stealers, top 5 countries, the victim numbers in the countries of the Nordic region. In addition, see the CryptPad spreadsheet for all more broad numbers.

Marketplace Updates Spreadsheet

Russian Market

Stealers by number of victims
Stealer nameNumber of victims
Lumma6,938,037
Vidar537,285
RisePro145,555
StealC739,296
RedLine192,195
Acreed475,948
Racoon5,093
Rhadamanthys154,180
Top 5 countries by number of victims
CountryNumber of victims
India1,066,664
Brazil671,204
Indonesia521,012
Egypt452,039
Pakistan390,656
Nordic region countries
CountryNumber of victims
Sweden18382
Denmark10039
Norway8115
Finland6511
Iceland944
Greenland138
Faroe91
Åland21

Exodus Market

Stealers by number of victims
Stealer nameNumber of victims
Lumma475,182
Rhadamanthys107,627
RedLine35,136
StealC26,673
Vidar11,577
Top 5 countries by number of victims
CountryNumber of victims
India71,762
Brazil50,468
Indonesia37,173
USA28,966
Philippines24,786
Nordic region countries
CountryNumber of victims
Sweden1,914
Denmark1,052
Norway825
Finland611
Iceland85

Articles/News

Mac.c stealer evolves into MacSync: Now with a backdoor

  • https://moonlock.com/macc-stealer-macsync-backdoor

Vidar Infostealer in Action

  • https://www.aryaka.com/docs/reports/vidar-infostealer-in-action.pdf