infostealer

I think passwords are a great place to start for people.

You know, if you know any one of your passwords, if you used it in more than one place, you should go change it immediately because, you know, as JT mentioned, not only could your passwords be leaked onto the dark web somewhere, they have InfoStealer malware who tap into the browser's built-in password management.

And so that's why you continually see browsers being updated with security because people have figured out how to pull the passwords out of the browser.

Could you imagine if all those saved passwords you have in Google for all your sites gets compromised, then the hackers will have them can just log right in.

Reported by SecurityWeek.

Volta Infostealer uses Claude, Gemini, and Kimi to rank victims by financial value.

The new Volta Infostealer sends stolen data to commercial LMS to score what is worth the most.

Attackers can then spend their effort on the highest-value victims, such as crypto holders and corporate credentials.

Defenders should expect faster, better-targeted follow-on abuse after an Infostealer infection.

Reported by The Hacker News Alpine Linux rebuilds GitLab after attempted RCE attack.

Attackers tried to exploit the critical GitLab flaw, which CISA says is under active exploitation, against Alpine Linux's development infrastructure.

One of the things that is especially troubling about that is historically, it was a little bit easier to link the indicators across the stages.

There was a recent investigation with the Remus Info Stealer that involved, at least in one example, it started with ClickFix behavior.

All of the ClickFix infrastructure is isolated from the rest of the chain.

Historically, sometimes I could look at domain registration records or look at some code involved in the JavaScript and make some links to later stages and have a better idea of being able to map out the whole sequence.

So now, when we think about, Josh, the malware strain that's earned the title for 2026 of most terrifying, what comes to mind?

Well, this one's really easy for me.

Last year, I crowned Loomis Stealer, which is an Info Stealer, as the most terrifying malware strain.

But this year, definitely the most terrifying malware strain we've seen is something called Remus Info Stealer.

So you're going to be busy with this this week also.

So yeah, InfoStealers looks like browser credentials, cookies, for many browser, AWS credentials, Google CloudAuth, platform service account keys, default app creds, and Microsoft Azure tokens.

It also swiped API keys for OpenAI, Anthropic, Cohere, and other LLM providers.

So just assume you've been thoroughly owned if you have used it in any way, shape, or form with your LLMs in the past couple days, so.