Infostealer Threat Group “Marko Polo” Evolving Into an “Empire”

Recorded Future research profiles the Marko Polo infostealer criminal group (active since 2022) which has rapidly expanded into an "infostealer empire" targeting high‑value cryptocurrency influencers and gaming personalities using over 50 malware payloads (including HijackLoader, Stealc, Rhadamanthys, AMOS), roughly 30 distinct scams, spearphishing/social engineering, and cross‑platform Windows and macOS tools, resulting in global reach and multimillion‑dollar thefts; the report recommends endpoint protection, web filtering, network segmentation, incident response planning, and security awareness training.