Report · 07 Nov 2026

Two Stealers, Two Prizes: Seven Days in the Infostealer Market's Blind Spot

Most infostealer reporting draws on the same mainstream feeds and tells the same story about Lumma, RedLine and Vidar. Our collection looks where those feeds rarely reach, and there, half of the infections we tracked over seven days came from a single free, open-source stealer. Among the malware behind the rest, one family stands out for a completely different appetite. Blank Grabber harvests Discord accounts at volume; WorldWind goes after Telegram sessions and crypto wallets. Together they describe a commodity market that no longer needs skill and is starting to specialize.

Key findings

• A free tool still does half the work. Blank Grabber, an open-source Python stealer anyone can download and build, accounted for about half of all infections in our collection over the seven-day window.
• The market is specializing. Nearly eight in ten Blank Grabber victims lost a Discord token. WorldWind, the second-largest malware family, took Telegram sessions from about seven in ten of its victims and crypto wallets from about one in six.
• Sessions are the prize. More than four in ten victims lost a Discord token and more than a quarter had browser cookies taken. The median machine with captured cookies gave up around 95 of them, each a potential live login.
• Tunisia is the epicenter of Blank Grabber activity. Nearly a third of located victims were in Tunisia, and the three Maghreb states together account for more than four in ten.
• The victims are undefended. More than four in five infected machines reported no identifiable security product, and an EDR agent appeared on a fraction of one percent.
• Enterprise exposure rides along. Logins for VPN and remote-access portals, developer platforms and Microsoft and Google sign-in pages sit in the same logs as gaming and social accounts.

Executive summary

Over the seven days to 7 November 2026, VERIDOME tracked infostealer logs from thousands of infected machines worldwide. They paint a picture of a mature commodity market, seen from an angle most public reporting does not cover. The single largest source of infections was Blank Grabber, a stealer whose source code is freely available and whose builder requires no programming at all. It accounted for about half of everything we saw. Credential captures from phishing and messaging lures, and the WorldWind stealer, made up most of the remainder at around a fifth each.

What stands out is how cleanly the operations divide the spoils. Blank Grabber is overwhelmingly a Discord-token harvester, responsible for close to nine in ten Discord tokens in the dataset. WorldWind is a different animal, built around Telegram sessions and cryptocurrency wallets, and it accounts for the large majority of both. These are separate tools working separate communities and cashing out separate assets.

The victims share one trait across families. More than four in five machines ran no identifiable security software, and the few that did mostly relied on the built-in Windows Defender. Geography is concentrated: among infections that could be located, Tunisia leads by a wide margin, followed by Saudi Arabia, the United States and Algeria. Attribution remains out of reach, because exfiltration runs over disposable chat-app infrastructure that leaves little behind to name or seize.

For defenders the lesson is practical. The assets being stolen fastest are live sessions, and the machines leaking them are often personal devices outside any corporate control that still hold the keys to corporate VPNs, developer accounts and cloud sign-ins.

A different vantage point

Readers used to mainstream infostealer reporting will notice what is missing here. Lumma, RedLine, Vidar and StealC, the malware-as-a-service families that dominate most industry telemetry, do not appear in this data, while free and lesser-known families sit at the top. That is a property of where we look, not a claim that the big names have gone away. VERIDOME's collection is built around sources that the commercial feeds behind most public reporting rarely reach, and this report describes that part of the ecosystem: the long tail of free, home-built and regional operations that sits largely outside the usual picture.

That also sets the limits of every figure that follows. The shares describe this collection, not the global stealer market as a whole, and they are best read alongside mainstream reporting rather than instead of it.

In the full report

1. Key findings
2. Executive summary
3. A different vantage point
4. Who is doing the stealing
5. Different families, different prizes
6. Where infections land
7. What gets taken
8. Sessions are the new passwords
9. Who gets hit
10. Infrastructure and attribution
11. Case studies
12. Israel: low volume, high density
13. MITRE ATT&CK mapping
14. Recommendations
15. Outlook
16. About this research
17. About VERIDOME

Request the full report (PDF)

More research from VERIDOME