From Stealers to Systems: The New Model of Credential Theft

TrendAI Research documents an active evolution of infostealer operations from mass-harvest, resale-focused campaigns to affiliate-driven, workflow-optimized systems: operators now offer managed build panels, recruit affiliates (e.g., CLR Team), and rotate payloads (Rhadamanthys, Vidar, Lumma) while automating log triage, enrichment, and exploitation (session/cookie theft, account recovery abuse); defenders are advised to shift from password-centric detection toward correlated identity/session telemetry and faster, system-level response.