All things infostealers. Week 27, 2025


A brief look at all things infostealers for the week 27, 2025 (30.06.2025–06.07.2025). This week didn’t observe any updates in infostealers. Grabbed some numbers from marketplaces and some interesting news/articles. And yes, sorry, was traveling and did not manage to the post on time.

Infostealer Updates

¯\_(ツ)_/¯


Marketplace Updates

This section provides some numbers taken from the marketplaces, which include numbers of victims based on stealers, top 5 countries, and the victim numbers in the countries of the Nordic region.

RussianMarket

Stealers by number of victims
Stealer nameNumber of victims
Lumma9,221,075
RisePro1,429,113
Vidar1,409,606
StealC1,040,520
RedLine789,347
Raccoon329,272
Acreed302,575
Rhadamanthys24,413
Top 5 countries by number of victims
CountryNumber of victims
India1,525,812
Brazil1,130,386
Indonesia785,271
Egypt718,524
Pakistan702,743
Nordic region countries
CountryNumber of victims
Sweden24,855
Denmark13,257
Norway10,433
Finland8,832
Iceland1,241
Greenland183
Faroe117
Åland21

ExodusMarket

Stealers by number of victims
Stealer nameNumber of victims
Lumma461,569
Rhadamanthys67,656
RedLine35,305
Unknown13,625
StealC10,141
Vidar4,733
Top 5 countries by number of victims
CountryNumber of victims
India63,765
Brazil45,681
Indonesia34,611
USA24,644
Philippines22,517
Nordic region countries
CountryNumber of victims
Sweden1,653
Denmark938
Norway731
Finland539
Iceland80

Articles/News

Taking SHELLTER: a commercial evasion framework abused in- the- wild

  • https://www.elastic.co/security-labs/taking-shellter

Atomic macOS Stealer now includes a backdoor for persistent access

  • https://moonlock.com/amos-backdoor-persistent-access