# Infostealer Campaigns (Lumma, RedLine, StealC) Harvesting AI Coding Agent and Developer Platform Credentials at Scale

> Lumma (56%), RedLine (17%), and StealC (13%) account for 86% of observed stealer-log volume in 2025-2026, harvesting browser passwords, session cookies, OAuth/application access tokens, and SSH keys from Windows developer machines. Over 3 million compromised credentials targeted AI coding and developer platforms in 2025 (OpenAI 3.1M+, Replit 204K, Hugging Face 186K, RunwayML 95K), and a May 2026 supply-chain incident used a trending fake Hugging Face repository to deliver a Rust-based stealer to 244K downloaders.

- **Published:** 2026-07-10T00:00:00Z
- **Last reviewed:** 2026-07-10T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1169
- **ID:** TL-2026-1169
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Three commodity Malware-as-a-Service (MaaS) infostealer families — Lumma (LummaC2), RedLine Stealer, and StealC — dominate the current stealer-log economy, together accounting for 86% of logs analyzed by SOCRadar across 2025. All three are subscription/builder-based MaaS products sold on underground forums and Telegram, licensed to affiliate operators who run their own distribution campaigns (trojanized software, malvertising, fake CAPTCHA/ClickFix verification pages, phishing). Once executed on a Windows host (98% of ~691,000+ infected machines observed were Windows), the stealers harvest browser-saved credentials and autofill data, active session cookies (which bypass MFA/2FA entirely), OAuth and cloud/CI-CD authentication tokens (GitHub, GitLab, AWS, Azure, GCP), SSH keys and local configuration files, cryptocurrency wallet data, and in RedLine/StealC's case Discord tokens, Steam, FileZilla, and VPN client (OpenVPN/ProtonVPN) credentials. Exfiltrated logs are packaged and sold in bulk on dark-web marketplaces to initial access brokers.

Of the 3+ million developer/AI-platform credentials exposed in 2025, OpenAI accounted for 3.1 million (dominant), Replit 204K, Hugging Face 186K, and RunwayML 95K — reflecting sustained affiliate targeting of AI coding-agent and MLOps platform sessions, where a single stolen session cookie or API key can grant persistent account and downstream cloud/CI-CD access without needing the victim's password. Quarterly volumes show 953K compromised accounts in Q1 2025, dropping to 553K in Q3 2025 following a May 2025 FBI/CISA-documented, Microsoft-led international law enforcement takedown of LummaC2 infrastructure (a temporary ~42% decline), then recovering to 857K by Q4 2025 as the MaaS operators rebuilt infrastructure.

LummaC2 is fileless in its final stage: it runs in memory, decrypts hard-coded/obfuscated C2 domains, and exfiltrates over HTTPS (migrated from plaintext HTTP in late 2023/early 2024 to evade network detection), using a distinctive '/c2sock' URI path and 'TeslaBrowser/5.5' user agent. RedLine Stealer, in use since 2020 and used in a majority of infostealer infections through 2023, communicates via SOAP-style HTTP with a 'SOAPAction: tempuri.org' header and is sold for $100-150/month on Telegram/underground forums; coordinated law-enforcement action disrupted core RedLine backends in late 2024, but repackaged builds persist. StealC, redesigned as v2 in March 2025 (subsequently iterated through v2.9.0 by December 2025, sold at $300/month by an operator using the moniker 'plymouth'), uses a JSON-over-HTTP(S) C2 protocol, supports EXE/MSI/PowerShell second-stage payload delivery, geofences victims by geolocation/HWID via its rebuilt web panel, and by v2.9.0 added Steam token collection without process injection, Perplexity Comet browser support, and full MetaMask IndexedDB grabbing.

A related May 2026 supply-chain incident illustrates the AI-platform targeting directly: a Hugging Face repository ('Open-OSS/privacy-filter') impersonating an OpenAI 'Privacy Filter' tool reached #1 trending with roughly 244,000 downloads before removal. Its loader.py disabled SSL verification, decoded a remote URL, and silently launched a hidden PowerShell chain (start.bat) that escalated privileges, added the payload to a Microsoft Defender exclusion, and deployed a Rust-based infostealer ('sefirah') targeting Chromium/Gecko browser credentials, Discord tokens, crypto wallets/seed phrases, SSH/FTP/VPN configs, OpenAI/Hugging Face/GitHub/cloud/CI-CD/package-registry tokens, .env files, and local project secrets, calling back to C2 domain recargapopular[.]com. Researchers found infrastructure overlap with additional malicious repositories and npm-distributed WinOS 4.0 implants, indicating a broader coordinated campaign against AI/developer supply chains rather than an isolated incident.

## MITRE ATT&CK

- T1566 Phishing
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1053 Scheduled Task/Job
- T1140 Deobfuscate/Decode Files or Information
- T1685 Disable or Modify Tools
- T1480 Execution Guardrails
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1553 Subvert Trust Controls
- T1218 System Binary Proxy Execution
- T1497 Virtualization/Sandbox Evasion
- T1555 Credentials from Password Stores
- T1539 Steal Web Session Cookie
- T1528 Steal Application Access Token
- T1217 Browser Information Discovery
- T1012 Query Registry
- T1518 Software Discovery
- T1082 System Information Discovery
- T1614 System Location Discovery
- T1016 System Network Configuration Discovery
- T1033 System Owner/User Discovery
- T1087 Account Discovery
- T1005 Data from Local System
- T1113 Screen Capture
- T1657 Financial Theft
- T1071 Application Layer Protocol
- T1132 Data Encoding
- T1105 Ingress Tool Transfer
- T1102 Web Service
- T1041 Exfiltration Over C2 Channel

## Sources

- [The AI Agent Credential Crisis: From Stealer Log to Source Code](https://socradar.io/blog/ai-agent-credential-stealer-log-source-code/)
- [Threat Actors Deploy LummaC2 Malware to Exfiltrate Sensitive Data from Organizations](https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-141b)
- [CSA: Threat Actors Deploy LummaC2 Malware](https://www.ic3.gov/CSA/2025/250521-2.pdf)
- [RedLine Stealer, Software S1240](https://attack.mitre.org/software/S1240/)
- [Lumma Stealer, Software S1213](https://attack.mitre.org/software/S1213/)
- [I StealC You: Tracking the Rapid Changes To StealC](https://www.zscaler.com/blogs/security-research/i-stealc-you-tracking-rapid-changes-stealc)
- [StealC V2 Malware Enhances Stealth and Expands Data Theft Features](https://www.picussecurity.com/resource/blog/stealc-v2-malware-enhances-stealth-and-expands-data-theft-features)
- [Fake OpenAI repository on Hugging Face pushes infostealer malware](https://www.bleepingcomputer.com/news/security/fake-openai-repository-on-hugging-face-pushes-infostealer-malware/)
- [Fake OpenAI Privacy Filter Repo Hits #1 on Hugging Face, Draws 244K Downloads](https://thehackernews.com/2026/05/fake-openai-privacy-filter-repo-hits-1.html)
- [The Rise of MaaS & Lumma Info Stealer](https://www.darktrace.com/blog/the-rise-of-the-lumma-info-stealer)
- [StealC Malware Profile & 7d C2 Tracker](https://www.derp.ca/stealc/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1169