#stealer
Infostealer infrastructure: panels, payloads and credential exfil endpoints
IOCs by window
0
IOCs tagged #stealer
0
IOCs tagged #stealer
21
IOCs tagged #stealer
656
IOCs tagged #stealer
Counts as of 2026-10-28. Regenerated daily.
About #stealer
- What: Malware that steals credentials and other secrets.
- Targets: Credentials, browser cookies, crypto wallets, autofill, FTP / SSH keys.
- Exfil: Sends the data to operator panels.
- MITRE:
T1555(Credentials from Password Stores) covers the credential grab. - Families: Lumma (LummaC2), RedLine, Vidar, Raccoon, MetaStealer, AgentTesla, Stealc.
- Detection: EDR rules, panel-URL blocklists, YARA on loaders, credential monitoring.
- References: MITRE ATT&CK T1555 · per-family tags #Lumma.
Recent IOCs tagged #stealer
Latest 10 IOCs from the past 30 days. Live JSON: api.tweetfeed.live/v1/month/stealer.
| Date | Type | Value | Source |
|---|---|---|---|
| ip | |||
| domain | |||
| url | |||
| ip | |||
| sha256 | |||
| ip | |||
| sha256 | |||
| ip | |||
| ip | |||
| ip |
Related tags
Frequently asked questions
What is an infostealer?
Malware that steals credentials, cookies, crypto wallets and other secrets. It sends them to an operator panel, and stolen credentials are often resold.
How do credentials from stealers end up being used?
Operators sell stolen credentials as logs. Buyers, often initial-access brokers or ransomware affiliates, replay them on corporate email, VPNs and cloud consoles.
How is this list updated?
The feed and the API update every 15 minutes from researcher posts on X. This page refreshes once a day.
What is the license? Can I use this commercially?
Yes. All IOC data, including this Stealer subset, is CC0 1.0 Universal. No attribution needed. No warranty. The website code and branding are not CC0.
License
Stealer IOC data: CC0 1.0 Public Domain. No attribution required, no warranty.