Research · 07 Nov 2026

The Stealers Most Feeds Miss: One Week of Infostealer Telemetry

Most infostealer reporting is built on the same mainstream feeds, dominated by malware-as-a-service families such as Lumma, RedLine and Vidar. This report looks somewhere else. Drawn from collection sources that commercial feeds rarely cover, a single week of telemetry shows a different market: free tools, chat-app logistics, and victims with no defenses at all.

Key findings

• Credential theft has fully commoditized. One free, open-source stealer, Blank Grabber, drove about half of all infections in our collection over the week.
• Live sessions have overtaken passwords as the prize. More than four in ten victims lost a Discord session token, which defeats passwords and MFA alike.
• Targeting is regional, not uniform. Among victims that could be located, North Africa and the Gulf dominate, led by Tunisia.
• The victims are the undefended. More than four in five machines ran no identifiable security product.
• The infrastructure is disposable. Exfiltration rides on consumer chat apps, leaving little durable command-and-control to seize or attribute.

The most important fact about modern credential theft is how little skill it now takes. Over a single week, one global telemetry pool surfaced a broad population of compromised Windows machines, and about half of them were hit by the same thing: Blank Grabber, a free, open-source stealer written in Python that anyone can download, compile, and point at a victim in an afternoon. No zero-day, no bespoke toolkit. A vending machine.

What the operators are after has shifted too. The sharpest signal in the week is not banking fraud or crypto theft but identity. More than four in ten victims had a Discord session token lifted from the infected machine, which lets an attacker walk into the account without ever touching the password or a second factor. A smaller share gave up a Telegram session the same way. Passwords are still the bulk cargo; live sessions are the premium product.

Put the pieces together and the week describes an economy rather than a campaign: cheap tooling, disposable infrastructure riding the chat apps everyone already runs, and a victim pool concentrated among the least defended machines on the internet. What follows takes that economy apart, and ends with what actually blunts it.

A different vantage point

Readers used to mainstream infostealer reporting will notice what is missing here. Lumma, RedLine, Vidar and StealC, the malware-as-a-service families that dominate most industry telemetry, do not appear in this data, while free and lesser-known families sit at the top. That is a property of where we look, not a claim that the big names have gone away. VERIDOME's collection is built around sources that the commercial feeds behind most public reporting rarely reach, and this report describes that part of the ecosystem: the long tail of free, home-built and regional operations that sits largely outside the usual picture.

That also sets the limits of every figure that follows. The shares describe this collection, not the global stealer market as a whole, and they are best read alongside mainstream reporting rather than instead of it.

A free tool does most of the work

Blank Grabber's share is the whole story of the week. It alone accounts for about half of everything we saw, with phishing and message-based theft and the WorldWind stealer splitting most of the rest at around a fifth each. Past that it is a long, thin tail of DarkCloud and bulk HTML credential logs. One free family, half the damage.

This is what a commoditized market looks like. Blank Grabber was never built to be clever. It is free, it is open source, its builder is point-and-click, and it travels the way commodity malware always has, bundled into cracked software, fake installers, game cheats, and "free" tools passed hand to hand across Discord servers and download sites. The barrier to running a credential-theft operation is now a weekend and a willingness to infect strangers, and the volume follows directly from that.

The logistics run on chat apps

The same consumer platforms attackers steal from are the ones they ship through. Blank Grabber and its peers exfiltrate over Discord webhooks and Telegram bots, channels that are free, encrypted in transit, trivially disposable, and all but indistinguishable from normal traffic to most network controls. Block one webhook and another is live in minutes.

That is why the Discord figure cuts both ways. A stolen Discord token doubles as a ready-made distribution node. Attackers use captured accounts to push the next round of lures to the victim's own friends and servers, which keeps the operation fed without standing up any new infrastructure. Theft, delivery, and spread collapse into a single app.

A regional map of opportunity

Geography is where the data is most interesting and most honest about its own limits. About half of all victims could not be geolocated at all, largely because location is recorded almost only in Blank Grabber logs, so the map is in effect a map of that one family. Among the machines that could be placed, the pattern is sharply regional rather than global.

Tunisia sits far out in front, with roughly three times the share of the next country, Saudi Arabia, followed by the United States, Algeria, Indonesia, and Morocco. Taken together, the three Maghreb states account for more than four in ten of the victims that could be located. The machines tell the same story from another angle: French-language Windows installations show up prominently, and Tunisian national education services rank among the most-targeted logins. That points to lure campaigns tuned to specific regions and languages rather than one undifferentiated spray. Commodity tooling does not mean undirected targeting. Someone is choosing where to fish.

What the thieves actually take

Most of what lands in a stealer log is mundane: the everyday web logins that pile up in a browser over years. The categories that carry real risk are smaller and sharper. Email and social accounts are the fast-moving goods, the ones that turn into money within hours through takeover, resale, and onward phishing, and the most-targeted services read exactly as you would expect: the major email and identity providers, the big social networks, Discord, and gaming platforms such as Roblox, Riot Games, and Steam.

The tail is where it gets uncomfortable. Government and education portals appear in the mix, including national services in the most affected countries, and a thin but real seam of banking and corporate credentials runs underneath. A single corporate login pulled from an employee's personal, unmanaged laptop is how commodity theft becomes business email compromise, and often enough the opening move of a ransomware intrusion. The low-value bulk and the high-value exception travel in the same log.

Who actually gets hit

The victim pool answers the question all that volume raises: who keeps falling for this? Overwhelmingly, it is Windows machines with little or nothing in the way. Windows 10 Pro dominates, Windows 11 trails well behind, and a long tail of LTSC, IoT, and Enterprise builds sits on the kind of specialized or forgotten endpoints nobody is watching.

The antivirus picture is the one that should keep defenders up at night. More than four in five machines reported no security product at all, or none that could be identified, and where something was present it was almost always the built-in Windows Defender. Almost none of it sits behind EDR. This is the soft underbelly of personal laptops, side machines, and small-business PCs, which is exactly the ground a free, high-volume stealer is built to farm. The tooling is cheap because the targets are easy.

No fingerprints left behind

Anyone hoping for clean attribution will be disappointed, and the honest move is to say so. No stable command-and-control infrastructure surfaces in this data, and nothing in it ties the activity to a single operator. That reflects the limits of the data. It says nothing about whether one crew or many sit behind it.

It is also what the economics predict. When exfiltration rides on throwaway Discord webhooks and Telegram bots that rotate faster than any blocklist can follow, there is little durable infrastructure left to seize or name. What the data does show is method, and the method is cheap, disposable, and resistant to the simple blocking that stops older malware. That is why the volume holds even as individual channels burn out, and why defenders should plan for an adversary with no fixed address.

Israel: low volume, high density

Israeli exposure over the week was marginal in volume, a fraction of a percent of the total. The one figure worth a second look is density: the compromised Israeli machines gave up far more credentials each than the global average, which points to a handful of heavily used devices with crowded browser vaults rather than any broad regional targeting. For defenders in Israel, it is a case for steady credential-exposure monitoring.

Techniques observed

Mapped to MITRE ATT&CK, the observed activity is narrow and consistent: credentials pulled from browser stores (T1555.003), live sessions taken through stolen cookies and application tokens (T1539, T1528), and exfiltration over legitimate web services, Discord webhooks included (T1567, T1567.004). These families typically gain a foothold through a user running a malicious file posing as cracked software or a game cheat (T1204.002). Nothing in the chain is exotic, which is exactly why it scales.

What defenders should actually do

None of this calls for exotic defenses. It calls for the unglamorous controls that specifically devalue a stolen password or a stolen session:

• Make passwords worth less. Phishing-resistant MFA, passkeys and FIDO2 rather than SMS codes, is the single highest-leverage move, because it breaks the credential replay the entire economy runs on.
• Treat session tokens as credentials in their own right. Stolen Discord and Telegram sessions walk straight past passwords and MFA, so shorten session lifetimes, force periodic re-authentication, and kill sessions on anomaly.
• Assume exposure and watch for it. Harvested logins can reach criminal markets within hours, so monitor your corporate and high-value domains against breach and stealer-log feeds and reset on a hit instead of waiting for abuse.
• Cover the machines nobody manages. The four in five with no real protection are the attack surface, and that includes the personal and side devices staff quietly use for work.
• Cut off the delivery vector. These families typically ride on cracked software, fake installers, and game cheats, so application controls and blunt guidance on pirated tooling do more here than any amount of signature chasing.

How this was compiled

These findings are a snapshot of the seven days to 7 November 2026. They reflect activity seen through VERIDOME's own collection, which runs continuously and is a defined slice of the wider infostealer ecosystem, deliberately weighted toward sources that mainstream feeds rarely cover, rather than the whole of it. The proportions describe the shape of the traffic we see over the week, not an absolute measure of global activity, and the real-world total is certainly far larger. As is standard practice, specific sources and collection methods are not disclosed.

Every figure is a proportion of the whole rather than a raw count, and the data is anonymized by design: it carries no victim identifiers, no stolen credentials, and no live indicators that could expose an individual or re-victimize anyone. Targeted services are described by category and well-known platform rather than by singling out specific organizations, because a login appearing in a stealer log reflects an infected user, not a breach of the service named. Attribution is avoided where the data cannot support it. The aim is to describe the shape of a threat, not to name the people caught in it.

About VERIDOME

VERIDOME Intelligence tracks infostealer activity and credential exposure across parts of the criminal ecosystem that conventional feeds miss, so organizations can find and close their own gaps before criminals reach them. This report draws on its continuous monitoring of the commodity-theft ecosystem.

More research from VERIDOME