Malware-as-a-service (infostealers)

Subscription stealers harvest credentials and tokens at scale

categoryPhysical, insider and cross-cutting attacksseverityHighdetectabilityHighlabnot yet measured

Example: Lumma Stealer

Classification

34 values: 18 imported, 2 derived, 14 machine-classified. What do these mean?

Exploitability

Attack vector	Credential attacksMalware
Reach (CVSS)	Local
Attack complexity	Low
Privileges required	None
User interaction	Active
Attacker skill required	Low
Resources required	Low
Likelihood / prevalence	High
Maturity	Commoditized

Impact & scope

Severity	High
Impact	ConfidentialityFinancial
Platform	IaaSLinuxmacOSOffice SuiteSaaSWindows
Environment	On-premises
Target asset class	EndpointIdentity
Kill-chain phase (tactic)	Credential Access

Detection & telemetry

Detectability	High
Testability	Atomic Red Team test
Data sources (ATT&CK data components)	Application Log ContentCloud Service EnumerationFile AccessFile ModificationLogon Session CreationOS API ExecutionProcess AccessProcess CreationUser Account Authentication

Detection & response

Mitigated by 32

M1017 attack-mitigation
M1021 attack-mitigation
M1026 attack-mitigation
M1027 attack-mitigation
M1032 attack-mitigation
M1047 attack-mitigation
M1051 attack-mitigation
M1054 attack-mitigation
D3-ANCI d3fend
D3-CCSA d3fend
D3-CF d3fend
D3-CH d3fend
D3-CM d3fend
D3-CQ d3fend
D3-CR d3fend
D3-CRO d3fend
D3-CTS d3fend
D3-DF d3fend
D3-DI d3fend
D3-DUC d3fend
D3-FA d3fend
D3-FE d3fend
D3-FEV d3fend
D3-FIM d3fend
D3-LFP d3fend
D3-MFA d3fend
D3-RD d3fend
D3-RF d3fend
D3-RFAM d3fend
D3-RIC d3fend
D3-SCA d3fend
D3-SCF d3fend

Detected by 23

DET0430 attack-detection-strategy
DET0509 attack-detection-strategy
24c77512-782b-448a-8950-eddb0785fc71 sigma
46612ae6-86be-4802-bc07-39b59feb1309 sigma
47147b5b-9e17-4d76-b8d2-7bac24c5ce1b sigma
4833155a-4053-4c9c-a997-777fcea0baa7 sigma
4b60e527-ec73-4b47-8cb3-f02ad927ca65 sigma
58f4ea09-0fc2-4520-ba18-b85c540b0eaf sigma
58f50261-c53b-4c88-bd12-1d71f12eda4c sigma
603c6630-5225-49c1-8047-26c964553e0e sigma
7679d464-4f74-45e2-9e01-ac66c5eb041a sigma
77564cc2-7382-438b-a7f6-395c2ae53b9a sigma
7892ec59-c5bb-496d-8968-e5d210ca3ac4 sigma
7a2a22ea-a203-4cd3-9abf-20eb1c5c6cd2 sigma
851fd622-b675-4d26-b803-14bc7baa517a sigma
99c49d9c-34ea-45f7-84a7-4751ae6b2cbc sigma
a1dfd976-4852-41d4-9507-dc6590a3ccd0 sigma
a4694263-59a8-4608-a3a0-6f8d3a51664c sigma
a840e606-7c8c-4684-9bc1-eb6b6155127f sigma
b120b587-a4c2-4b94-875d-99c9807d6955 sigma
d0dae994-26c6-4d2d-83b5-b3c8b79ae513 sigma
d557dc06-62e8-4468-a8e8-7984124908ce sigma
fc028194-969d-4122-8abe-0470d5b8f12f sigma

Tested by 39

079ee2e9-6f16-47ca-a635-14efcd994118 atomic
124e13e5-d8a1-4378-a6ee-a53cd0c7e369 atomic
1864fdec-ff86-4452-8c30-f12507582a93 atomic
1b83cddb-eaa7-45aa-98a5-85fb0a8807ea atomic
234f9b7c-b53d-4f32-897b-b880a6c9ea7b atomic
26a6b840-4943-4965-8df5-ef1f9a282440 atomic
28498c17-57e4-495a-b0be-cc1e36de408b atomic
29d0c390-3cbc-4e4e-a52b-a1350ed836b7 atomic
36753ded-e5c4-4eb5-bc3c-e8fba236878d atomic
3d111226-d09a-4911-8715-fe11664f960d atomic
4a16a770-c1fc-494a-8131-022a0b147b3a atomic
4b437357-f4e9-4c84-9fa6-9bcee6f826aa atomic
5c32102a-c508-49d3-978f-288f8a9f6617 atomic
6f2c5c87-a4d5-4898-9bd1-47a55ecaf1dd atomic
70422253-8198-4019-b617-6be401b49fce atomic
764ea176-fb71-494c-90ea-72e9d85dce76 atomic
87e88698-621b-4c45-8a89-4eaebdeaabb1 atomic
88e1fa00-bf63-4e5b-a3e1-e2ea51c8cca6 atomic
8c05b133-d438-47ca-a630-19cc464c4622 atomic
8fd5a296-6772-4766-9991-ff4e92af7240 atomic
9a2915b3-3954-4cce-8c76-00fbf4dbd014 atomic
9c2dd36d-5c8b-4b29-8d72-a11b0d5d7439 atomic
a6a5ec26-a2d1-4109-9d35-58b867689329 atomic
afe369c2-b42e-447f-98a3-fb1f4e2b8552 atomic
b647f4ee-88de-40ac-9419-f17fac9489a7 atomic
bc071188-459f-44d5-901a-f8f2625b2d2e atomic
c1402f7b-67ca-43a8-b5f3-3143abedc01b atomic
c89becbe-1758-4e7d-a0f4-97d2188a23e3 atomic
db965264-3117-4bad-b7b7-2523b7856b92 atomic
dc9cd677-c70f-4df5-bd1c-f114af3c2381 atomic
e359627f-2d90-4320-ba5e-b0f878155bbe atomic
e43cfdaf-3fb8-4a45-8de0-7eee8741d072 atomic
e544bbcb-c4e0-4bd0-b614-b92131635f59 atomic
e57ba07b-3a33-40cd-a892-748273b9b49a atomic
e5e3d639-6ea8-4408-9ecd-d5a286268ca0 atomic
eb8da98a-2e16-4551-b3dd-83de49baa14c atomic
ec1d0b37-f659-4186-869f-31a554891611 atomic
f543635c-1705-42c3-b180-efd6dc6e7ee7 atomic
fa714db1-63dd-479e-a58e-7b2b52ca5997 atomic

Attack relationships

Child: Credentials from password stores / vaults
Child: Infostealer

Framework references

Primary source: https://blogs.microsoft.com/on-the-issues/2025/10/16/mddr-2025/
attack: T1555 (primary)
attack: T1539

Evidence & sources

ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Physical, insider and cross-cutting attacks' table, line 709 of Cyber-Attack-Taxonomy.md
ev-0002 (Seeded-record enrichment run 2026-09-30 (crosswalk + facet classification)) — Crosswalk to attack:T1555, attack:T1539 as the nearest framework entries; ids verified to exist in the cached catalogues.
ev-0003 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 29 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
ev-0004 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 40 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)