# Infostealer Malware: What Lumma, RedLine, and Vidar Steal and What to Do Next URL: https://limehawk.io/reports/infostealer-malware Published: 2026-10-02 Author: Corey Watson, Managing Member Topic: Guides Read time: 7 min Lumma, RedLine, and Vidar steal saved passwords and login cookies. Isolate the PC, reimage it, then reset passwords and sessions from a clean device. > **TL;DR** An infostealer is malware built to copy what your browser remembers: saved passwords, autofill data, crypto wallets, and the login cookies that keep you signed in. A stolen cookie can let someone walk into your email without ever seeing an MFA prompt. Lumma, RedLine, and Vidar are the big names. All three have been hit by law enforcement or replaced, and all three kept going in some form. If a machine is infected: pull it off the network, have IT reimage it, then reset passwords and sign the account out everywhere from a different, clean device. Next time, keep passwords out of the browser, run EDR someone watches, and block unknown downloads. - PCs infected with Lumma in 2 months: 394,000+ ## What should I do right now if a PC has an infostealer? Disconnect the PC from the network, stop using it, and call IT. Don't log in to anything else on that machine, and don't wipe it yourself before IT has looked. Then, from a different device you trust, change your email password and have IT sign you out of every session. Everything typed or saved on that PC should be treated as stolen. Here's the order we'd follow: 1. **Unplug it.** Pull the network cable or turn off Wi-Fi. Leave it powered on so IT can see what ran. 2. **Don't sign in to anything on it.** Every new login on an infected machine is another password handed over. 3. **Call IT.** They'll want to know what was downloaded or clicked and when. If you're a client of ours, this is a critical ticket. 4. **Use a clean device.** A different computer or your phone, not the infected one. 5. **Reset email first, then banking, then everything else** that was saved in that browser. 6. **Revoke sessions.** Have IT sign the account out everywhere. A new password alone doesn't kill a stolen cookie (more on that below). 7. **Reimage the PC.** Wipe and reinstall Windows, then restore files from backup. That's an IT job, after they've looked at what happened. If you're not sure the PC is infected, see [signs your computer is hacked](/reports/signs-your-computer-is-hacked). If it started with a fake "verify you are human" page, read our [ClickFix fake CAPTCHA guide](/reports/clickfix-fake-captcha-malware) too. ## What is infostealer malware? An infostealer is malware that copies your stored credentials and sends them to an attacker. It goes after browser passwords, autofill, credit cards, crypto wallets, and session cookies. The stolen bundle is called a "log," and the [Justice Department says](https://www.justice.gov/usao-wdtx/pr/us-joins-international-action-against-redline-and-meta-infostealers) logs are "sold on cybercrime forums and used for further fraudulent activity and other hacks." Most infostealers are sold as a service. One crew writes and runs the malware. Paying customers, called affiliates, run their own campaigns to infect people. That's why taking down one tool rarely ends anything. The affiliates move to the next one. They don't need to break anything to get in. Somebody has to run them. [Microsoft documented](https://www.microsoft.com/en-us/security/blog/2025/05/21/lumma-stealer-breaking-down-the-delivery-techniques-and-capabilities-of-a-prolific-infostealer/) Lumma arriving through phishing emails, fake ads in search results for things like "Notepad++ download," and fake CAPTCHA pages. Bitdefender says Lumma infections are "primarily driven by social engineering" rather than exploits. Fake downloads are their own topic. See our guide on [malvertising and fake software downloads](/reports/malvertising-fake-software-downloads). ## How can a stolen cookie get past MFA? When you sign in and pass MFA, the site gives your browser a session cookie so it doesn't ask again on every click. An infostealer copies that cookie. The attacker loads it into their own browser and shows up already signed in, past the password and the MFA prompt. The DOJ put it plainly: RedLine and META can "bypass multi-factor authentication (MFA) through the theft of authentication cookies." That changes the cleanup. Resetting the password stops new sign-ins, but a session that's already open can keep working until it expires or someone kills it. Microsoft's [emergency access revocation guide](https://learn.microsoft.com/en-us/entra/identity/users/users-revoke-access) has admins disable the account and select **Revoke sessions**, and it notes that access tokens last an hour by default. Google Workspace admins have a matching control: **Security > Sign-in cookies > Reset**, which [signs the user out of browsers and mobile devices](https://knowledge.workspace.google.com/admin/devices/sign-a-user-out-of-a-managed-google-account). Google notes it doesn't sign them out of desktop apps like Drive for desktop. Then IT should read the sign-in logs in Microsoft 365 or Google. They're looking for sign-ins from places you weren't, new MFA methods you didn't add, and new inbox rules. That last one is how an infostealer turns into [business email compromise](/reports/business-email-compromise). If your email was opened, the next risk is a fake wire request, so [verify wire instructions](/reports/how-to-verify-wire-instructions) by phone. ## What happened to Lumma Stealer? Lumma was disrupted in May 2025 and came back within weeks. On May 21, 2025, [Microsoft announced](https://blogs.microsoft.com/on-the-issues/2025/05/21/microsoft-leads-global-action-against-favored-cybercrime-tool/) a court-ordered action against roughly 2,300 malicious domains behind Lumma. It said it found over 394,000 Windows computers infected with Lumma between March 16 and May 16, 2025. The same day, the [Justice Department seized five domains](https://www.justice.gov/opa/pr/justice-department-seizes-domains-behind-major-information-stealing-malware-operation) that hosted Lumma's control panels, and said the FBI had identified at least 1.7 million instances of Lumma stealing information. CISA and the FBI published a [joint advisory on LummaC2](https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-141b) that day too. It didn't stay down. [Trend Micro reported](https://www.trendaisecurity.com/en-us/resources-insights/trendai-security-blog/lumma-stealer-returns) on July 22, 2025 that Lumma activity was climbing again from June to July. On February 11, 2026, [Bitdefender wrote](https://www.bitdefender.com/en-us/blog/labs/lummastealer-second-life-castleloader) that "LummaStealer is back at scale," often delivered alongside a loader called CastleLoader and through fake CAPTCHA pages. ## What was RedLine Stealer, and is it gone? RedLine was one of the most common infostealers in the world until Operation Magnus. On October 29, 2024, the [Justice Department announced](https://www.justice.gov/usao-wdtx/pr/us-joins-international-action-against-redline-and-meta-infostealers) it had joined the Netherlands, Belgium, Eurojust, and other partners to seize domains, servers, and Telegram accounts used by RedLine and the closely related META stealer. It charged Maxim Rudometov, whom it described as one of RedLine's developers and administrators. The DOJ said RedLine spread through malvertising, phishing emails, fake software downloads, and fake Windows update lures. It also said investigators found millions of stolen usernames and passwords in the logs. That's the useful part for you: logs stolen years ago still get sold and reused. Any password that was saved on an infected machine should be considered burned. ## What is Vidar Stealer? Vidar is an older infostealer, around since 2018, that got a full rewrite in 2025. [Trend Micro reports](https://www.trendaisecurity.com/en-us/resources-insights/trendai-security-blog/how-vidar-stealer-2-upgrades-infostealer-capabilities) that the developer announced Vidar 2.0 on October 6, 2025. It goes after browser credentials, crypto wallets, cloud credentials, FTP and SSH accounts, Steam, Discord, and Telegram. Trend Micro tied the release to a drop in Lumma activity and expected criminals looking for a Lumma replacement to move to Vidar and StealC. The names change, but the cleanup and prevention are the same for all of them. ## How do we stop the next infostealer? You stop the next one by having less in the browser to steal and fewer ways for the malware to run. Three controls do most of the work. - **Don't save passwords in the browser.** Use a password manager instead. An infostealer's first stop is the browser's saved logins, and a password manager isn't the browser's built-in store. It also makes "reset everything" a list instead of a guessing game. - **Run EDR that someone watches.** EDR flags the behavior of a stealer grabbing browser data and calling home, and lets IT cut the PC off the network remotely. Here's [the difference between EDR and antivirus](/reports/edr-vs-antivirus). On our [managed IT and security](/services/managed-it-security) plan, EDR runs on every machine and alerts go to a person. - **Block unknown downloads.** Standard users shouldn't be admins, and Windows can be set to block executables that don't meet a prevalence, age, or trusted list criterion. That's one of Microsoft's [attack surface reduction rules](https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-reference). It stops a lot of fake installers. On the identity side, [phishing-resistant MFA](/reports/phishing-resistant-mfa) won't stop a stolen cookie, but Microsoft's [token protection guidance](https://learn.microsoft.com/en-us/entra/identity/devices/protecting-tokens-microsoft-entra-id) shows how risky-sign-in policies and device-bound tokens make a stolen session much less useful. Write all of this into your [incident response plan](/reports/incident-response-plan-template) so nobody is figuring out the order at 4 p.m. on a Friday. ## Key takeaways - Infostealers copy saved browser passwords, autofill data, crypto wallets, and session cookies. A stolen cookie can skip MFA entirely. - Lumma was disrupted in May 2025 and came back within weeks. RedLine was hit by Operation Magnus in October 2024. Vidar 2.0 shipped in October 2025. Takedowns slow these tools down. They don't end them. - If a PC is infected: disconnect it, don't keep using it, and have IT reimage it. Cleaning an infostealer in place isn't worth the risk. - Reset passwords and revoke sessions from a clean device, starting with email. A password reset alone doesn't kill a stolen cookie. - Prevention is boring and works: a password manager instead of the browser, monitored EDR, and blocking unknown downloads. ## What this looks like when we do it For our managed clients, an infostealer alert gets the same treatment as any critical ticket: a human on it in under 15 minutes. EDR lets us isolate the PC remotely, so step one doesn't depend on someone finding the network cable. From there we pull the M365 or Google sign-in logs, revoke sessions, check for new MFA methods and inbox rules, and reimage the machine from a known-good build. Files come back from backup. For a [financial advisory firm](/industries/financial-advisors), a stolen login is a Regulation S-P question, not just a reset. That's why the baseline for those firms includes EDR, email filtering, and password management, so passwords aren't sitting in the browser to begin with. The [financial advisors page](/industries/financial-advisors) covers the rest of that baseline, and our [managed IT and security page](/services/managed-it-security) covers how monitoring and response work for every client. Worried a machine in your office already ran something it shouldn't have? Book a call and we'll walk through it.