The Modern Malware Economy: Infostealers
Today, cybercriminals rarely bother writing custom zero-days when they can simply purchase a **Commodity Infostealer** (such as Lumma Stealer or RedLine) for $150 a month on dark-web forums.
Infostealers are distributed through trojanized software, cracked games, fake Zoom installers, or fake "Verify you are human" browser prompts that trick users into pasting PowerShell commands into the Windows Run box (`Win+R`).
The 4-Second Extraction Sequence
Once executed, the malware runs in less than 4 seconds: 1. It accesses the user's Chrome directory: `%LOCALAPPDATA%\Google\Chrome\User Data\Default\`. 2. It extracts the encrypted SQLite databases containing saved passwords and active session cookies. 3. It calls the Windows Data Protection API (`CryptUnprotectData`) to decrypt the master AES key. 4. It compresses all credentials, browser history, and cryptocurrency extension keys into a `.zip` archive. 5. It transmits the archive via an encrypted **Discord Webhook** or Telegram Bot API.
Because Discord and Telegram are trusted platforms, network egress filters rarely block the upload.
The Antidote: Device-Bound Session Credentials (DBSC)
Google and the web standards community are deploying **Device-Bound Session Credentials (DBSC)**. DBSC creates a public/private key pair inside the computer's physical **TPM security chip**. When the browser communicates with a website, it signs each request with the hardware chip. If an infostealer steals the cookie file and sends it to an attacker in another country, the cookie fails because the attacker does not possess the physical TPM chip!