# Stealer Logs: Infostealer Malware Ecosystem Fuels Credential-Theft Economy (LummaC2, Rhadamanthys, Vidar 2.0, StealC, AMOS/MacSync/Poseidon/Odyssey)

> A cross-platform Malware-as-a-Service (MaaS) infostealer ecosystem — LummaC2, Rhadamanthys, Vidar 2.0, ACRStealer/Acreed and StealC on Windows, plus Atomic macOS Stealer (AMOS), MacSync, Poseidon and Odyssey on macOS — harvests browser credentials, session cookies/SSO tokens, autofill and payment data, cryptocurrency wallets, and VPN/FTP/cloud application tokens, packaging them into 'stealer logs' resold on Russian Market, Telegram, and dark web forums. Two major law-enforcement disruptions in 2025 (LummaC2 in May, Rhadamanthys in November) failed to eliminate the ecosystem, with market share consistently migrating to surviving or new families within days to weeks.

- **Published:** 2026-07-25T00:00:00Z
- **Last reviewed:** 2026-07-25T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1693
- **ID:** TL-2026-1693
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Infostealer MaaS Operators (Russia)
- **Detections:** 9 · **IOCs:** 36 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Stealer logs have become the upstream access-broker commodity of the cybercrime economy: infostealer malware silently exfiltrates browser-stored passwords, active session cookies/authentication tokens (which bypass MFA entirely when replayed), autofill and payment-card data, cryptocurrency wallet files and seed phrases, hardware/device fingerprints, and VPN/FTP/SaaS application tokens (Slack, Discord, GitHub, cloud consoles) from infected endpoints, then packages the harvest into structured 'logs' for resale.

On Windows, the dominant families through 2025-2026 are LummaC2 (Lumma Stealer), Rhadamanthys, Vidar 2.0, ACRStealer (rebranded/succeeded by Acreed), and StealC/StealC v2 — all operated as subscription-based MaaS platforms with affiliate programs, update bulletins, and dedicated customer support channels on underground forums and Telegram. On macOS, Atomic macOS Stealer (AMOS) dominated through most of 2025 before a temporary disappearance in October 2025 and a February 2026 return; its codebase was forked by former AMOS developer 'Rodrigo4' into Poseidon Stealer, which was itself rebranded and upgraded into Odyssey Stealer, while MacSync (formerly Mac.C) emerged as the primary commodity macOS stealer by year-end 2025.

Delivery increasingly relies on social-engineering execution rather than exploiting software vulnerabilities: ClickFix fake-CAPTCHA pages that trick victims into pasting and running attacker-supplied commands, malvertising, trojanized software/crack downloads, fake Homebrew or crypto-wallet installers on macOS, and abuse of signed system binaries (mshta.exe proxying obfuscated remote JavaScript). LummaC2 has also been observed using 'EtherHiding' — hosting or resolving second-stage payload locations via Binance Smart Chain smart contracts — while Vidar uses a Telegram/Mastodon 'dead-drop resolver' pattern to fetch its live C2 IP, both techniques designed to survive conventional domain/IP takedown actions.

Law enforcement has twice struck at the ecosystem's core infrastructure without eliminating it. Operation Endgame's May 2025 action (DOJ, Europol EC3, Japan's JC3, and Microsoft's Digital Crimes Unit) seized over 2,300 domains tied to LummaC2, which had infected roughly 400,000 Windows machines between March 16 and May 16, 2025 alone; LummaC2 only partially recovered market share by early 2026. Operation Endgame's third phase (10-14 November 2025) seized more than 1,000 servers and 20 domains tied to Rhadamanthys, VenomRAT, and the Elysium botnet — Rhadamanthys alone had generated 525,303 unique infections across 226 countries between March and November 2025 — yet activity simply redistributed to Vidar 2.0 and other surviving families. This 'hydra' pattern, combined with 1.8 billion credentials stolen in 2025, an 84% year-over-year increase in phishing-delivered stealers (IBM X-Force), 54% of ransomware victims having had domain credentials already present in stealer logs before their attack (Verizon 2025 DBIR), and 77% of Russian Market logs containing SSO tokens (ReliaQuest), establishes stealer logs as a durable, self-healing access-broker commodity feeding downstream account-takeover fraud and ransomware intrusions.

## MITRE ATT&CK

- T1082 System Information Discovery
- T1518.001 Security Software Discovery
- T1217 Browser Information Discovery
- T1012 Query Registry
- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1195 Supply Chain Compromise
- T1204 User Execution
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1059.006 Python
- T1059.010 AutoHotKey & AutoIT
- T1218.005 Mshta
- T1218.015 Electron Applications
- T1218.007 Msiexec
- T1547.001 Registry Run Keys / Startup Folder
- T1176 Software Extensions
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1027.013 Encrypted/Encoded File
- T1685 Disable or Modify Tools
- T1564.003 Hidden Window
- T1574.001 DLL
- T1574.001 DLL
- T1036.008 Masquerade File Type
- T1553.002 Code Signing
- T1622 Debugger Evasion
- T1497.001 System Checks
- T1620 Reflective Code Loading
- T1119 Automated Collection
- T1555.003 Credentials from Web Browsers
- T1555 Credentials from Password Stores
- T1539 Steal Web Session Cookie
- T1528 Steal Application Access Token
- T1113 Screen Capture
- T1115 Clipboard Data
- T1005 Data from Local System
- T1074.001 Local Data Staging
- T1041 Exfiltration Over C2 Channel
- T1071.001 Web Protocols

## Sources

- [Stealer Logs: The Underground Commodity Powering Modern Cybercrime](https://www.darkowl.com/blog-content/stealer-logs-the-underground-commodity-powering-modern-cybercrime/)
- [Threat Actors Deploy LummaC2 Malware to Exfiltrate Sensitive Data from Organizations (AA25-141B)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-141b)
- [Lumma Stealer, Software S1213](https://attack.mitre.org/software/S1213/)
- [FBI and Europol Disrupt Lumma Stealer Malware Network Linked to 10 Million Infections](https://thehackernews.com/2025/05/fbi-and-europol-disrupt-lumma-stealer.html)
- [Europol and Microsoft disrupt world's largest infostealer Lumma](https://www.europol.europa.eu/media-press/newsroom/news/europol-and-microsoft-disrupt-world%E2%80%99s-largest-infostealer-lumma)
- [Lumma Stealer: Breaking down the delivery techniques and capabilities of a prolific infostealer](https://www.microsoft.com/en-us/security/blog/2025/05/21/lumma-stealer-breaking-down-the-delivery-techniques-and-capabilities-of-a-prolific-infostealer/)
- [Rhadamanthys infostealer operation disrupted by law enforcement](https://www.helpnetsecurity.com/2025/11/13/rhadamanthys-infostealer-operation-disrupted/)
- [Operation Endgame Dismantles Rhadamanthys, Venom RAT, and Elysium Botnet in Global Crackdown](https://thehackernews.com/2025/11/operation-endgame-dismantles.html)
- [Fast, Broad, and Elusive: How Vidar Stealer 2.0 Upgrades Infostealer Capabilities](https://www.trendmicro.com/en_us/research/25/j/how-vidar-stealer-2-upgrades-infostealer-capabilities.html)
- [StealC v2 Malware Enhances Stealth and Expands Data Theft Features](https://www.picussecurity.com/resource/blog/stealc-v2-malware-enhances-stealth-and-expands-data-theft-features)
- [The Rise of Acreed Infostealer](https://www.bitsight.com/blog/the-rise-of-acreed-infostealer)
- [Rhadamanthys | Red Canary Threat Detection Report](https://redcanary.com/threat-detection-report/threats/rhadamanthys/)
- [Odyssey Stealer: The Rebrand of Poseidon Stealer](https://www.cyfirma.com/research/odyssey-stealer-the-rebrand-of-poseidon-stealer/)
- [osx_atomic.txt — Atomic macOS Stealer OSINT indicator list](https://raw.githubusercontent.com/stamparm/maltrail/master/trails/static/malware/osx_atomic.txt)
- [IBM X-Force 2025 Threat Intelligence Index](https://www.ibm.com/reports/threat-intelligence?ce=ISM0484)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1693