Infostealers Do Not Need Exploits. They Need Your LOLBAS.

Most stealer alerts fire after browser data has already left the host. EDR is often correct when it names Lumma, Vidar, or StealC. What produced the log is usually a signed Windows binary (mshta, rundll32, PowerShell, or conhost) that was allowed to fetch and run a loader.

Scope

Ransomware.live's Infostealer Intelligence dashboard correlates Hudson Rock stealer logs with domains that later appeared as ransomware victims on that platform. Snapshot, August 2026: [15]

25,939 domains with stealer exposure
415,155 employees exposed
32,545,583 users exposed
20 stealer families

Ransomware.live Infostealer Intelligence dashboard showing 25,975 domains tracked, 415,660 employees exposed, and 32,552,249 users exposed across 20 stealer families, with RedLine and Lumma as the top families by volume. Data snapshot from August 2026. — Source: ransomware.live/infostealer - August 2026 snapshot

These totals are not global infection counts. They measure overlap between stealer logs and domains that later showed up as ransomware victims. RedLine is still the largest slice of that historical pile because older logs stay in the dataset after the family is disrupted. Treat the screenshot as a point in time and use the live dashboard for current figures.

Related reporting:

Flashpoint: more than 11.1 million infected devices in 2025 and 7.4 million in H1 2026, about 1.7 billion credentials in six months. [1][2][3]
SpyCloud: 642 million exposed credentials from 13.2 million infections in 2025. [16]
CybelAngel: 54 percent of ransomware victims already had domain credentials in stealer logs before the attack. [17]

Loss figures are not filed as "Lumma." What can be cited:

IBM Cost of a Data Breach: global average $4.44 million. Credential-based breaches about $4.67 million. [18]
FBI IC3 / Constella summary of the 2025 Internet Crime Report: $16.6 billion to $20.9 billion in reported U.S. cybercrime losses. BEC about $3.0 billion. Infostealers are an input to ATO, BEC, and ransomware, not that entire figure. [17][19]
Underground pricing: a commodity log is often around $10. A verified corporate password is tens of dollars. A working VPN or identity-provider session is often hundreds. Packaged initial access can reach the low thousands. [17][20]

The operational gap sits earlier than the family name. A signed copy of mshta or rundll32 is allowed to fetch a loader, and the resulting log can be sold before the SOC ticket has an owner. Application control is the control that can deny that execution. The policy question is whether those binaries are allowed to act as downloaders on a standard workstation.

Observed families, late 2024 to mid 2026

Family rankings move after every takedown. The table below is the set that actually moved volume in public reporting from late 2024 through mid 2026, not a permanent top five.

Family	Why it mattered	Public reporting
Lumma (LummaC2)	Dominant in 2025 until the May 2025 disruption. Reappeared via clones such as Remus.	Recorded Future described it as the year's dominant threat. Microsoft sinkholed hundreds of thousands of hosts. Fake CAPTCHA and mshta chains were common. [4][5]
Vidar	Absorbed displaced affiliates. Flashpoint had it leading in early 2026.	Telegram and Steam dead-drop C2. Often delivered by Amadey. Also observed behind ClickFix and fake AI installers. [1][2][6]
StealC	Persistent MaaS family. Microsoft and partners disrupted StealC and Amadey infrastructure in June 2026.	Amadey loads plugins through rundll32, cmd, and PowerShell. Affiliates handle delivery. [6]
Acreed / ACR / Amatera	Filled the post-Lumma gap. Microsoft reported a surge against enterprise customers from April to June 2026.	Two documented ClickFix chains: WebDAV + rundll32, and mshta + in-memory PowerShell. Later WordlistLoader and EtherHiding. NetSupport in some follow-on activity. [7][8][9][10]
Rhadamanthys	Top five in 2025. Led for a period after Lumma, then a November 2025 disruption.	Premium MaaS. SEO-poisoned software. HTTPS with Tor fallback. Still observed in C2 reporting after the takedown. [1][4]

RedLine was the leading family through 2024 until Operation Magnus in October 2024 took the panel and part of the affiliate base offline. It still appears in Hudson Rock-style log piles because those records are not removed when the panel dies. An older infection can still show a domain, an employee mailbox, and stolen session data. That is useful for exposure and credential hygiene. It is a weak basis for a 2026 prevention policy. Hash rules for a disrupted builder will not cover Vidar, StealC, Acreed, or the clone that shipped after the last takedown.

Affiliates also do not rewrite delivery when they switch builders. The reused pattern is ClickFix into mshta or rundll32, a loader injected into a Microsoft-signed host, a cheap log sold on Telegram, and a signed RMM (NetSupport, ScreenConnect, AnyDesk) if the access is worth more than the log. Durable controls target that shared execution set, not the brand on this month's builder.

Host chain

Infostealer attack chain diagram showing six steps — traffic, user action, LOLBAS staging, and loader where application control can prevent execution, followed by stealer and RMM persistence where EDR is too late to stop credential theft.

Traffic. SEO-poisoned downloads, malvertising, cracked software, fake AI tools, or a compromised site injecting a fake CAPTCHA (ClearFake / ClickFix).
User action. Run a fake installer, or paste a clipboard command into the Run dialog.
Staging with LOLBAS. powershell.exe, mshta.exe, rundll32.exe, conhost.exe, cmd.exe, sometimes curl.exe or msiexec.exe.
Loader. Amadey, CastleLoader, WordlistLoader, Emmenhtal, HijackLoader, PureCrypter. Injection into MSBuild.exe is common.
Stealer. Browser databases, cookies, tokens, wallets, sometimes OneDrive and SharePoint files. The log is sent to C2. Many builds self-delete.
Optional follow-on. NetSupport, ScreenConnect, AnyDesk, a clipper, or sale of the log into a ransomware affiliate panel.

Application control can allow or deny execution at steps 2 through 4, before the stealer runs. EDR typically operates at steps 5 and 6, when it can name the family, the C2, or an unexpected remote tool. That telemetry is useful for response. It does not revoke a cookie or token that has already left the host.

Microsoft made the same split in the ACR write-up: application control can restrict launching content from a remote resource using PowerShell, Python, mshta.exe, or rundll32.exe, especially from user-writable paths. [7][8] That is a WDAC policy decision, not new detection content.

Shared tradecraft

Stage	Shared behavior	Tools	Constraint
Initial execution (ClickFix)	Fake CAPTCHA or error overlay copies a command. Victim uses Win+R, paste, Enter. Parent is usually explorer.exe.	powershell.exe (iex / iwr), mshta.exe against a remote HTA, cmd.exe, conhost.exe --headless	Script enforcement and Constrained Language Mode. Deny mshta as a general-purpose downloader. Treat explorer -> powershell/mshta with a remote URL as hostile by default.
Remote object execution	Payload is pulled from WebDAV, a CDN, or an image host.	rundll32.exe + WebDAV / pushd, mshta.exe, curl.exe as a child of mshta	Deny rundll32 loads from UNC, WebDAV, or user-writable paths. Deny unexpected mshta child processes.
Loader and injection	Loader unpacks the stealer in memory. Host process is a Microsoft-signed binary.	MSBuild.exe, dllhost.exe, wab.exe, rundll32.exe loading plugin DLLs (Amadey pattern)	Constrain children of those hosts. Block unsigned modules in those processes. Deny unknown executables from %TEMP% and %APPDATA%.
Follow-on access	Stealer is often short-lived. The profitable next step is a signed RMM.	NetSupport (client32.exe), ScreenConnect / ConnectWise, AnyDesk, SimpleHelp, Atera, often via msiexec.exe	Allow only RMM publishers IT licenses, on the machines that need them.
Trust abuse	Fake installer that still launches the real application. Sideloaded DLL. Short-lived or revoked Authenticode.	Signed decoy EXE + malicious install.res.*.dll / autorun.dll. msiexec on an unsigned or revoked MSI.	Pair publisher rules with known abused RMM publishers and known sideload pairs. Do not treat "signed" as trusted.
Defense evasion after foothold	Less common on the first stealer beat. Common once the log becomes an intrusion.	BYOVD. Vulnerable or abused drivers from LOLDrivers.	MagicSword plus the Microsoft vulnerable driver blocklist.

Not sure where to start? Never Say Never It's Time to Block LOLBAS.

Documented examples:

ACR / Amatera (Microsoft, July 2026). ClickFix to rundll32 loading a DLL from WebDAV. Second chain: ClickFix to mshta to obfuscated PowerShell, payload extracted from a JPEG. [7][8]
WordlistLoader into Amatera (Gen Digital / The Hacker News, August 2026). ClickFix, conhost --headless, pushd, rundll32. ClearFake inject on a compromised site. [9]
EVALUSION into Amatera and NetSupport. PureCrypter-packed DLL injected into MSBuild.exe, then PowerShell to retrieve NetSupport. [10]
StealC and Amadey (Microsoft, June 2026). Amadey as delivery. Plugin DLLs via rundll32. Additional payloads as EXE, MSI, or PowerShell. [6]
Lumma fake CAPTCHA (Netskope). Native mshta.exe fetches a remote HTA. The HTA launches hidden PowerShell and reflectively loads Lumma. [5]
Amadey pay-per-install dropping Vidar. HTA plus curl.exe. Separate lineage used ConnectWise MSI packages with legitimate-looking certificates. [11]
ScreenConnect as second stage. Red Canary listed malicious ScreenConnect among monthly top threats through 2026. Microsoft documented signed-looking workplace-app lures that install ScreenConnect via msiexec. [12][13][14]

What is uncommon in current high-volume reporting is a standalone unsigned stealer.exe sitting in Downloads as the first-stage tool. Campaigns stage through signed Windows binaries and loaders, then a signed RMM when the access is valuable enough to keep.

What to enforce

WDAC (App Control for Business) is the enforcement point. LOLBAS, LOLRMM, and LOLDrivers are the input catalog. If political capital is limited, do not start with a full allow list of every business application. Start with the abuse cases stealers need.

Script hosts. Enable script enforcement and Constrained Language Mode where operationally possible. If that is too broad, deny mshta spawned from Explorer or the browser except for required line-of-business exceptions. Audit explorer.exe -> powershell.exe with remote or encoded content.
rundll32 and WebDAV. Deny loads from UNC, WebDAV, and user-writable paths. Scope any packaging exception to a specific signer and path.
User-writable execution. Do not allow unsigned or newly dropped binaries from %TEMP%, %APPDATA%, %LOCALAPPDATA%, or C:\Users\Public on a standard workstation.
Unapproved RMM. Allow only the remote tools IT licenses, on the hosts that need them. Block NetSupport, ScreenConnect, AnyDesk, and similar tools elsewhere.
Drivers. Enforce the Microsoft vulnerable driver blocklist and LOLDrivers. WDAC can prevent a known-vulnerable signed driver from loading.
Signer context. Pair publisher rules with abused RMM publishers and known sideload pairs. Do not allow an entire CA because a small set of internal tools uses it.

Start in audit so helpdesk scripts and packaging pipelines can get exceptions before enforce mode.

Here's how that loop actually works in practice.

Then apply the denies on workstations that do not need those tools, and keep scoped exceptions where IT actually operates them.

Application control and MagicSword

Application control decides whether mshta, rundll32, an unapproved RMM, or a vulnerable driver is allowed to run. EDR still provides visibility and response after execution. One layer prevents. One layer investigates. Both are required.

MagicSword is that prevention layer on WDAC. It maps current LOLBAS, LOLRMM, LOLDrivers, and signer-abuse intelligence into policy Windows already knows how to enforce, without adding a kernel driver that has to coexist with EDR. When a technique shows up in the wild, the intelligence behind the affected policy refreshes on a short cycle. Operators review and push. They do not rebuild an XML by hand each quarter.

A regional government in Germany runs this coverage across about 1,100 endpoints with roughly half an FTE and a 30-minute review every two weeks. The operating requirement is a control that stays in enforce, not a workshop policy that never leaves audit.

Application control does not replace Conditional Access, token revocation, or phishing-resistant authentication. A session stolen on an unmanaged home PC still bypasses MFA when the user opens Outlook on the web. It also will not help if the only allow rule is "signed." That is how a fake OBS installer or a revoked ScreenConnect MSI lands.

Family names will change. The Windows binaries used to stage the next family will not. Constraining those binaries closes the path the replacement builder will reuse.