Malware Brief: How infostealers turn stolen identities into cybercrime currency

How modern infostealers steal browser credentials, session cookies, and authentication tokens to hijack digital identities

Key takeaways

• Infostealers now target complete digital identities, not just passwords. Browser credentials, session cookies, authentication tokens, and active sessions can all help attackers impersonate legitimate users.
• Stolen sessions can weaken the protection MFA provides. Attackers may be able to hijack accounts that users have already authenticated.
• Lumma Stealer’s rebound shows how resilient the infostealer ecosystem has become. Disruptions can slow operations, but established malware services can rebuild and return with new delivery tactics.
• Acreed reflects criminals’ growing demand for low-cost identity theft tools. New infostealers are emerging to harvest browser data and feed the underground market for ready-made digital identities.
• Organizations need to protect identities and browser sessions alongside endpoints and data. Reducing account-takeover risk requires visibility and controls across credentials, tokens, cloud access, and user activity.

For years, cybercriminals used malware to steal data, encrypt systems, or establish persistence inside networks. Increasingly, however, malware is being used for a different purpose: stealing identities. Modern infostealers harvest browser credentials, authentication tokens, session cookies, and other data that allow attackers to impersonate legitimate users. Recent developments involving Lumma Stealer, the booming infostealer economy, and the Acreed infostealer show how stolen identities are becoming one of cybercrime’s most valuable commodities.

Lumma Stealer rebounds after a major takedown

Key facts

• Type: Infostealer-as-a-service
• Primary target: Browser-based identities
• Capabilities: Credential theft, cookie theft, token theft
• Distribution: Fake CAPTCHAs, phishing, malicious downloads
• Why it matters: Can enable account takeover even when multifactor authentication (MFA) is in place

Law enforcement and industry partners disrupted Lumma Stealer’s infrastructure in 2025, but the malware has proven remarkably resilient. Researchers report that Lumma has rebuilt its operations and is once again spreading through fake CAPTCHA pages, malicious downloads, and ClickFix-style social engineering campaigns.

Unlike traditional credential stealers, Lumma targets entire digital identities. It can harvest browser credentials, session cookies, authentication tokens, and cryptocurrency wallet data, giving attackers access to accounts that users have already authenticated.

Infostealers fuel a massive stolen-identity market

Key facts

• Type: Malware-driven criminal ecosystem
• Primary target: Digital identities
• Data stolen: Passwords, tokens, cookies, and browser profiles
• Primary risk: Account takeover and business email compromise
• Why it matters: Attackers increasingly want identities, not just credentials

The discovery of a database containing billions of stolen records highlighted the scale of today’s infostealer ecosystem. Much of the data appears to have originated from malware designed to harvest credentials, browser data, and active sessions from compromised devices.

The story isn’t really about passwords. Modern infostealers collect complete browser profiles that can contain cloud credentials, authentication tokens, and active sessions. The result is a thriving underground marketplace for ready-made digital identities.

Acreed targets browsers and digital identities

Key facts

• Type: Infostealer
• Primary target: Browser credentials and digital identities
• Capabilities: Credential theft, cookie theft, wallet theft
• Data stolen: Passwords, autofill data, authentication tokens, and cryptocurrency assets
• Why it matters: Gives criminals another low-cost tool for stealing complete digital identities

Acreed is a relatively new infostealer that has gained traction among cybercriminals looking for an alternative to older malware families such as RedLine and Raccoon. The malware focuses on harvesting browser credentials, autofill data, authentication cookies, cryptocurrency wallets, and other information that can be used to hijack accounts or commit fraud.

Like many modern infostealers, Acreed is less interested in infecting systems for the long term and more interested in quickly collecting valuable identity data that can be sold or reused in follow-on attacks. Its emergence is another reminder that cybercriminals increasingly view digital identities as a commodity.

It’s all about identity

These stories point to the same trend: Cybercriminals are increasingly focused on stealing digital identities rather than simply stealing passwords or deploying ransomware. As browsers, SaaS platforms, and cloud services become central to business operations, protecting identities, sessions, and authentication tokens is becoming just as important as protecting endpoints and data.