Account Credential-Stealing Malware Detected by AhnLab MDS (Web Browsers, Email, FTP)

This AhnLab technical report documents how infostealer malware (e.g., AgentTesla, Lokibot) and custom tools used by APT groups (Andariel, Kimsuky) extract stored account credentials from browsers, email and FTP clients, outlining the operational risk of credential theft and demonstrating how AhnLab MDS’s sandbox-based behavioral analysis detects and alerts on these information-exfiltration behaviors.