In today’s digital landscape, cybersecurity threats are evolving at an unprecedented pace. Rupert Marais, our in-house Security specialist, brings a wealth of expertise in endpoint and device security, cybersecurity strategies, and network management. In this interview, Rupert sheds light on the looming threat of infostealers on Australia’s financial sector, a topic addressed by recent findings from Dvuln researchers. Rupert’s insights reveal the intricacies of this pervasive yet underreported menace and offer guidance on strengthening defenses against such threats.
What are infostealers, and how do they operate to harvest banking credentials?
Infostealers are sophisticated malware designed to infiltrate consumer devices and extract sensitive data, like banking credentials. These malware variants target vulnerable devices, stealthily collecting information through techniques such as keylogging, screen scraping, or sniffing network traffic. Infostealers capitalize on existing vulnerabilities, grabbing credentials stored in software or from users as they input them into websites. Their method of operation allows them to secure vast sets of data without needing to breach the systems directly.
How have infostealers impacted the Australian financial sector according to the Dvuln researchers?
The impact on the Australian financial sector has been significant and growing. The researchers at Dvuln highlighted a marked increase in credential theft over several years, affecting customers of major banks. This trend indicates that infostealers enable malicious actors to bypass traditional defenses, resulting in increased unauthorized access to individual accounts and subsequent financial fraud. The sector faces a dual challenge: protecting its own network while ensuring that public-facing digital assets are secure.
Could you explain the trends observed in the number of stolen credentials from the Australian banks between 2021 and 2025?
From 2021 to 2023, there was a steady increase in stolen credentials, suggesting that infostealers were becoming more effective or widespread. Interestingly, the logs revealed a slight decline in 2024, which could imply an improvement in security measures or a temporary shift in cybercriminal priorities. However, the cumulative trend underscores the persistent threat these systems pose and the need for ongoing vigilance by financial institutions.
Why did the researchers refer to infostealer malware as “one of the most pervasive yet underreported threats” to Australia’s financial sector?
Infostealers operate quietly, often under the radar of traditional security systems, which explains their description by Dvuln researchers. These threats are insidious because they infiltrate end-user devices rather than organizational infrastructure directly. As they don’t often trigger overt alarms in conventional security setups, there is a lack of visibility, leading to underreporting and an underestimated threat level across the sector.
How do infostealers facilitate malicious activities such as account takeovers and fraudulent transactions?
Once infostealers access credentials, they can trigger account takeovers by exploiting authentication tokens or cookies for active sessions. This means they can impersonate legitimate users without suspicion, executing fraudulent transactions or initiating identity-based financial fraud. This unauthorized access lays the foundation for extensive financial crime, with long-lasting effects on victims and their financial institutions.
What role do cybercrime marketplaces play in the distribution and monetization of data stolen by infostealers?
These marketplaces are central to the infostealer economy, enabling the exchange of stolen data among various malicious entities. Cybercriminals who harvest data using infostealers can sell it to access brokers, who then distribute it to ransomware operators seeking infiltration points. Such online marketplaces create a structured environment where stolen data is commoditized, enhancing the scale and efficiency of cybercrime operations.
How have modern infostealers evolved to bypass traditional security measures like multi-factor authentication (MFA)?
Modern infostealers have advanced to intercept authentication cookies that enable continued access once MFA has initially authenticated a user. By capturing these cookies, infostealers exploit a window of vulnerability, accessing sessions that bypass the original authentication check points like MFA. This evolution points to the necessity for more dynamic security approaches that secure ongoing interactions, not just initial logins.
Can you explain how authentication cookies are exploited by infostealers, and why this presents a security vulnerability?
Authentication cookies store user credentials during a session, allowing seamless navigation without frequent logins. Infostealers target these cookies to hijack sessions, thereby assuming a user’s identity without raising alarms that a typical new login might. The threat stems from the prolonged access after a successful login, giving attackers time to explore accounts and conduct unauthorized transactions before detection.
What is meant by “token-based continuous access evaluation,” and why is it recommended as a security control?
Token-based continuous access evaluation assesses user access throughout their session, not just at login points. This measure continuously checks the validity and security of authentication tokens to detect anomalies or unauthorized activities. By monitoring access in real-time, it significantly strengthens security posture against threats like infostealers that exploit static or unchecked sessions.
Why are traditional security controls ineffective against the infostealer model?
Traditional controls often focus on perimeter defenses or infrastructure-level attacks. Infostealers skirt around these by infiltrating end-user devices, avoiding direct engagement with institutional security systems. This indirect attack form means the infostealer threat doesn’t manifest in straightforward ways, rendering conventional security measures insufficient in isolation.
What specific actions did the researchers recommend for financial institutions to combat the threat of infostealers?
Researchers advocate for a broader security strategy beyond MFA, including continuous access evaluation and heightened authentication for high-risk transactions. They recommend financial institutions create mechanisms to recognize and nullify compromised tokens swiftly. Additionally, fostering awareness among customers about the nature and risks of infostealer malware is crucial to reinforce security from the user’s end.
How can targeted customer awareness campaigns help in mitigating risks associated with infostealer malware?
These campaigns educate customers about potential threats lurking in their devices and digital interactions. By promoting safer online practices, reminding them of the risks from unmanaged data or software, and how to spot suspicious activities, institutions empower users to become proactive in protecting their own credentials. Enhanced awareness can lead to better collective defense against these threats.
Do you have any advice for our readers?
Stay educated about the digital hazards in today’s environment. Safeguard your devices with regular updates and steer clear of suspicious sites and downloads. Consider using security software that watches for infostealer activities, and always adopt a cautious mindset. Remember, an informed approach is your first line of defense in the ever-evolving cybersecurity battle.
