Infostealers Crash Course: A Tradecraft Tuesday Recap

This Huntress report reviews the evolution and current threat landscape of infostealer malware, detailing historic families (Zeus, RedLine), recent source-code leaks (Banshee) spawning macOS variants, major underground marketplaces, law enforcement takedowns (Genesis, Lumma, RedLine), and observed in-the-wild incidents (Lumma delivery disguised as Notion with artifacts like "raretemp"). It describes the types of data infostealers harvest (SSO/SSAML, Slack tokens, API keys, MFA/OTP, crypto wallets), distribution methods (phishing, malvertising, trojanized apps), common IOCs and TTPs, and recommended mitigations such as MFA, EDR, patching, and user training.