Malware

RedLineStealer

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

2 techniques

T1583Acquire InfrastructureEvidence1

Infostealers are most commonly deployed via phishing, malvertising and fake or misleading posts on social media.

T1608.006SEO PoisoningEvidence1

It is likely that users accessing the page were searching for a legitimate copy of a tool or searching innocuous phrases such as 'printable calendars' or 'business models' and being presented with the malicious URL at the top of their search results.

Initial Access

2 techniques

T1078Valid AccountsEvidence1

Kroll frequently sees threat actors, particularly ransomware gangs, leveraging valid accounts to gain a foothold in corporate networks.

T1566PhishingEvidence1

Infostealers are most commonly deployed via phishing, malvertising and fake or misleading posts on social media.

Persistence

1 technique

T1078Valid AccountsEvidence1

Kroll frequently sees threat actors, particularly ransomware gangs, leveraging valid accounts to gain a foothold in corporate networks.

Privilege Escalation

1 technique

T1078Valid AccountsEvidence1

Kroll frequently sees threat actors, particularly ransomware gangs, leveraging valid accounts to gain a foothold in corporate networks.

Stealth

2 techniques

T1036MasqueradingEvidence1

These offer free downloads of AI chatbots such as ChatGPT and Google Bard but lead users to download REDLINESTEALER.

T1078Valid AccountsEvidence1

Kroll frequently sees threat actors, particularly ransomware gangs, leveraging valid accounts to gain a foothold in corporate networks.

Credential Access

2 techniques

T1539Steal Web Session CookieEvidence1

Its main functionality is to steal data such as passwords, credit card information, usernames, locations, cookies and hardware configuration from infected systems.

T1555Credentials from Password StoresEvidence1

REDLINESTEALER collects this data from a number of sources, including: Installed browsers, such as SQLite databases VPN credentials Crypto wallets (such as files containing *.wallet) Chat messages FileZilla credentials

Discovery

1 technique

T1082System Information DiscoveryEvidence1

REDLINESTEALER can gather detailed information about victims’ systems, such as IP address, city and country, operating system, administrator privileges and information about infected PC hardware and graphic cards, as well as identifying any installed antivirus software on the system.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence2

REDLINESTEALER can also download files, making it likely that further payloads could be deployed to a victim device, should a threat actor require more functionality depending on their objectives, such as high bandwidth data exfiltration or ransomware.

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app2 years ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

vmray blogNews

Aug 11, 2026

Deleting the Defenders: A Commodity BYOVD Toolkit That Erases Host Safeguards

Mentioned only as an unrelated malware family sharing the generic WinRAR SFX stub fingerprint in open-source records.

polyswarmNews

Jan 5, 2026

PolySwarm’s 2025 Year in Review

.NET-based information stealer harvesting browser data, credentials, and wallet information, often leading to ransomware deployments.

kroll blogNews

Aug 14, 2024

REDLINESTEALER Malware Driving Initial Access Broker Market| Cyber Risk | Kroll

An information-stealing malware offered via underground subscription that steals passwords, credit card data, usernames, locations, cookies, hardware configuration, VPN credentials, crypto wallet files, chat messages, and FileZilla credentials from infected systems. It can also profile victim systems and download additional files/payloads.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

RedLineStealer

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

2 techniques

T1583Acquire InfrastructureEvidence1

Infostealers are most commonly deployed via phishing, malvertising and fake or misleading posts on social media.

T1608.006SEO PoisoningEvidence1

Initial Access

2 techniques

T1078Valid AccountsEvidence1

Kroll frequently sees threat actors, particularly ransomware gangs, leveraging valid accounts to gain a foothold in corporate networks.

T1566PhishingEvidence1

Infostealers are most commonly deployed via phishing, malvertising and fake or misleading posts on social media.

Persistence

1 technique

T1078Valid AccountsEvidence1

Kroll frequently sees threat actors, particularly ransomware gangs, leveraging valid accounts to gain a foothold in corporate networks.

Privilege Escalation

1 technique

T1078Valid AccountsEvidence1

Kroll frequently sees threat actors, particularly ransomware gangs, leveraging valid accounts to gain a foothold in corporate networks.

Stealth

2 techniques

T1036MasqueradingEvidence1

These offer free downloads of AI chatbots such as ChatGPT and Google Bard but lead users to download REDLINESTEALER.

T1078Valid AccountsEvidence1

Kroll frequently sees threat actors, particularly ransomware gangs, leveraging valid accounts to gain a foothold in corporate networks.

Credential Access

2 techniques

T1539Steal Web Session CookieEvidence1

Its main functionality is to steal data such as passwords, credit card information, usernames, locations, cookies and hardware configuration from infected systems.

T1555Credentials from Password StoresEvidence1

Discovery

1 technique

T1082System Information DiscoveryEvidence1

Command and Control

1 technique

T1105Ingress Tool TransferEvidence2

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app2 years ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

vmray blogNews

Aug 11, 2026

Deleting the Defenders: A Commodity BYOVD Toolkit That Erases Host Safeguards

Mentioned only as an unrelated malware family sharing the generic WinRAR SFX stub fingerprint in open-source records.

polyswarmNews

Jan 5, 2026

PolySwarm’s 2025 Year in Review

.NET-based information stealer harvesting browser data, credentials, and wallet information, often leading to ransomware deployments.

kroll blogNews

Aug 14, 2024

REDLINESTEALER Malware Driving Initial Access Broker Market| Cyber Risk | Kroll

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.