Key Themes
Introduction
Attackers have shifted from exploiting perimeter weaknesses to logging in with stolen identities, bought from specialised credential marketplaces.
By the time a bank detects fraud, it is watching the final act of a story that began months earlier.
Picture the actual sequence: a customer downloads what looks like a free PDF converter, or clicks a sponsored search result that mimics a tool they already use. Nothing appears to happen, but in the background, an infostealer copies every password saved in their browser, their session cookies, their autofill details, and the corporate login they use for work, then deletes itself.
The customer notices nothing, their bank notices nothing, because from the bank’s side nothing has happened yet.
Six weeks later, on a normal Tuesday, someone logs in with the stolen password, gets past the one-time code by phoning the customer while posing as the bank, and moves the money. That login is the first thing the bank ever sees. By then it is the last step, not the first.
As an industry, we’ve talked about an infostealer infection for over a decade, but we discuss it as if it were an event: something that happens, gets detected, gets cleaned, and ends. Except it is not an event, and treating infostealer infection in banking fraud as a one-off incident misses what it actually is.
It is a supply line. And that single reframe changes what widespread even means.
When a device is compromised by a stealer, what leaves is not a password. It is a package: saved logins across every site the victim ever touched, session cookies that let an attacker skip authentication entirely, autofill identity data, crypto wallet files, and increasingly the corporate single sign-on tokens sitting in the same browser as the online banking.
That package is called a log. And a log is not consumed once. It is refined and resold, keyed to whichever crime pays best that week. The same log is inventory for four different crimes: account takeover, mule account onboarding, session hijacking and ransomware, and the criminal economy is specialized enough that four different operators buy the parts they need.
The credential is the preferred front door, because it is quieter than malware.
The attacker no longer breaks in. They log in with something valid, and nothing on your perimeter triggers an alert, because from the system’s point of view a legitimate user just arrived.
And it is worse than a stolen password, because the log contains the session cookie too. Multi-factor authentication does not stop a stolen session cookie, because the cookie is issued after it has been passed.
A password can be reset and multi-factor authentication is supposed to catch whoever holds it. A stolen session cookie answers to neither. It is the token your systems issue after a customer has already passed the password and the second factor, the proof that says this session is trusted, do not ask again.
The cookie works until the session ends, which is why attackers move quickly. Replay that cookie and the attacker walks straight past the login, past the one-time code, past the authentication a bank spent years and a fortune deploying, and lands inside an already-trusted session
For an institution that treats multi-factor authentication as the finish line, this is the uncomfortable part: the thing you invested in does not stop this. The stealer did not defeat your authentication. It waited until your customer passed it, then copied the receipt.
Group-IB’s 2026 trend research makes the structural version of this point: stolen tokens, keys, and service accounts have overtaken traditional malware as the primary way attackers get in.
Infostealers play a large part in the rise of credential-based intrusions, which means the right measure for 2026 and beyond is not how many devices are infected; it is how many valid credentials are in circulation. And infostealers are the input to almost everything else.
Infostealers feed ransomware and banking fraud
The scale of this is not theoretical, and law enforcement has now put numbers on it. Between January and April 2025, INTERPOL ran Operation Secure, a takedown of infostealer infrastructure across Asia and the South Pacific that Group-IB contributed intelligence to alongside other private-sector partners.
The results: more than 20,000 malicious IP addresses and domains taken down, 41 servers seized, over 100 GB of data recovered, and 32 arrests across Vietnam, Sri Lanka, and Nauru. Group-IB’s contribution focused on stealer families including Lumma, Risepro, and METAStealer. In Hong Kong alone, investigators mapped 117 command-and-control servers (C2) hosted across 89 internet service providers, the central hubs running phishing, online fraud, and social media scam campaigns.
The figure that matters most is the last one. After the operation, more than 216,000 victims and potential victims were notified and told to change passwords and check their accounts for unauthorized access. INTERPOL’s own framing of why is the point of this section: infostealer logs are traded on the criminal underground and serve as a gateway for further attacks, including ransomware and fraud.
That is the mechanism, stated by law enforcement rather than a vendor. A stealer log is not a one-off crime. It is the raw material for the next four. This is where the comparison people reach for breaks down.
Ransomware holds your data and demands you pay to get it back, which at least implies an ending. A stealer log has no ending. It is not held against you, it is sold around you, repeatedly, to buyers you will never see, monetized again every time a fresh use case appears.
The customer whose log was harvested in January is not compromised once. They are compromised for as long as the credential still works, which is usually far longer than anyone assumes, because nobody told them and nothing in the transaction stream ever fired.
Cybercrime is an industry and a marketplace, and infostealers are the primary extraction engines
The industry framing is established, and it is a decade old. Another equally important version is that cybercrime is a marketplace, and a marketplace has no center to attack. It just repositions around your defense. Stealer-as-a-service is what that marketplace looks like at the credential layer. But it does not sit beside fraud-as-a-service; it sits inside it.
In a way, the entire adversary kill chain hasn’t changed but is now up for rentals. The same marketplace that rents you the stealer will sell you the phishing kit to deploy it, the logs harvested by someone else’s stealer if you would rather buy than farm, the mule accounts already seasoned and waiting to receive funds, and the cash-out service at the end. Every stage of the criminal chain, infrastructure to credentials to takeover to cash-out, is available to rent, from a different specialist, with a review score.
The adversary that we think we’re up against isn’t one, it’s many.
Group-IB’s tracking of Phantom Stealer shows exactly this. Between November 2025 and January 2026, researchers followed a sustained phishing campaign against logistics, manufacturing, and technology firms across Europe, run in five distinct waves. The emails mimicked legitimate procurement correspondence, professional signatures and spoofed sender identities, and hid an infostealer in the attachment designed to harvest browser credentials, session tokens, and payment data.
Group-IB Business Email Protection blocked every one of these emails before it reached its recipient. Phantom Stealer is sold commercially as part of a bundled toolkit. It is not a group’s private weapon. It is a subscription product, and the pattern of hitting multiple unrelated companies on the same day is the signature of a service being rented, not a target being chosen.
The market feeding them is not small, and it is getting harder to watch
Group-IB’s 2026 research found that public listings of corporate access fell by 27%, as the most valuable deals, domain admin accounts, VPN panels, SaaS logins, moved into private channels where they never reach open markets. Which means the visible market is the shallow end. The credentials that matter most are already changing hands where you cannot see them at all.
The chain is fully integrated on their side. The defense, meanwhile, is fully partitioned on ours – that asymmetry is the name of the game.
Where the infostealer sits in detection: in the middle, unowned and overlooked
The credential layer does not escape detection because it is hidden but because it surfaces at the one point on the chain where no team is looking.
The first box, infrastructure. The look-alike domain, the hosting, the phishing kit. Cyber sees this. Domain monitoring, certificate transparency, brand protection – it is theirs. The last two boxes, takeover and cash-out. The unfamiliar device, the anomalous session, the payment that should not be going where it is going. Fraud sees this – it is theirs.
Now the middle box: credential theft: Now the middle box: credential theft. The moment the stealer silently copies the passwords and session cookies saved on the customer’s device. No corporate perimeter was touched, so no alert fired and the cyber team saw nothing.
The fraud team has not yet stood up as there is no session, no transaction, no anomaly to score, because from the transaction stream’s point of view nothing has happened at all. The customer is simply, quietly, compromised.
The silo is exactly why the adversary aims for it on purpose. The reason stealer detection never got stronger: we have been pointing the wrong way for decades.
Every conversation about stealers runs cyber to fraud: intelligence watches the underground, spots the credential, warns the fraud team before it is spent. That direction is real and it is valuable, and it is also, at this point, the consensus. Everyone selling threat intelligence tells that story. Few can back it up with intelligence from their own investigations into the groups behind the attacks.
The direction nobody is telling is the other one. Fraud to cyber. And it is the direction most institutions overlook.
Here is the mechanism: a stealer-as-a-service operation is a business, and a business has to get paid. The subscription has to clear, the logs have to sell, and the proceeds have to move. Every one of those transactions touches a payment instrument: an account, a wallet, a processor relationship. Which means the criminal enterprise that is invisible at the network layer, no malware sample in your lab, no intrusion on your estate, is fully visible at the money layer, because criminals find it much harder to stay anonymous where money changes hands.
The credential leaves little trace. The payment usually leaves more.
So read the arrow backwards. The suspicious outbound pattern your fraud team flagged and could not fully explain, the recipient account that passed every compliance check and still felt wrong, the freshly onboarded account that cleared know-your-customer cleanly and then behaved strangely: those are not just fraud signals.
Read from the other side, that account is evidence of an active stealer operation, sitting in a fraud queue, waiting for someone to recognize what it is. The money trail can help attribute the operation. It just arrives at the fraud’s telemetry and is seen as their problem, when it is also a way to identify the people behind a cyber operation that the security team has been trying to attribute from the network side and failing.
You cannot always see the malware, but you can often follow the money
This is what Group-IB Suspicious Payment Details productizes: it turns that handoff into a workflow. Beyond telling you a threat exists, it tells you where the money goes, delivering payment identifiers attributed to active criminal operations into fraud and AML workflows, so the bank can stop a payment to a recipient account tied to a criminal payment chain at authorization, rather than discovering it afterwards. Pair that with new-account and mule detection on the onboarding side, and you are watching both ends of the enterprise’s cash flow: the inflow of stolen identity used to open accounts, and the outflow of proceeds moving through them. You are not detecting the stealer. You are following its accounts payable.
Because your fraud team is not only a consumer of intelligence, but a sensor. It watches something no endpoint tool on earth can see, the live behavior of millions of payments, which is to say the live cash flow of the criminal operations targeting you.
Owning the middle box: fusion, prediction, and shared intelligence
Go back to the empty box. The credential-theft stage that cyber has left and fraud has not yet reached, the one whose job description reads nobody sees. Everything in this piece has been an argument that the box exists and that the adversary aims for it on purpose
If the adversary is not one actor but a chain of rented services stitched into one operation, then the operation is a campaign, not an incident. And if it is a campaign, then every place you currently watch it is watching a fragment. The entire proposition of cyber fraud fusion is to bring these fragments together by design.
The reason to move upstream is that the window before a transaction and the window after it are not the same fight. The weeks a campaign spends being assembled are not dead time, they are the window where a threat is still just a signal, and Group-IB sits inside it at every stage.
While attacker infrastructure is still being registered and staged, Threat Intelligence and Digital Risk Protection are already watching it. While a stolen credential sits in a log waiting to be used, it may already have surfaced in the underground feeds Group-IB scans.
While mule accounts are being seasoned across dozens of banks, the Group-IB Cyber Fraud Intelligence Platform sees the pattern no single bank can. At every one of those moments the threat can still be stopped, and nothing has yet been lost.
The moment the transaction fires, that window closes. What was a signal becomes a loss, and almost everything left to do is recovery rather than prevention. So prediction is not a feature. It is the choice to act while the threat is still a signal instead of once it is a loss, and the reason Group-IB can make that case is that it operates across the whole window, not just the last second of it.
The industry is going to move this way regardless. The only variable is whether any given institution moves before the campaign reaches it or after. The attacker already fused.
The uncomfortable truth is that the criminal ecosystem has better intelligence sharing than the industry defending against it. They pool, they specialize, they trade signals in real time. We hold ours in silos and call it security.
