RedLine

RedLine Stealer is a Windows information-stealing malware family written in C# that emerged in early 2020 and became one of the most widely used commodity stealers in the cybercrime ecosystem. It is commonly sold and deployed as part of malware-as-a-service and pay-per-install operations, and has frequently appeared alongside other crimeware families such as loaders, stealers, miners, and proxy malware. RedLine has been used both for direct theft from individual victims and as an upstream access source for broader intrusions, including enterprise and cloud account compromise.

Its core functionality centers on theft of browser-saved credentials, session cookies, and other sensitive user data. Reported use cases include harvesting credentials later abused to access SaaS platforms, VPNs, cloud file-sharing services, and enterprise identities. RedLine has also been associated with collection of browser data, wallet-related information, and screenshots, making it relevant to both account takeover and financially motivated operations. Stolen session material can enable follow-on abuse without requiring password re-entry or MFA at the time of replay.

RedLine is regularly delivered through opportunistic social-engineering and malware distribution channels rather than bespoke exploitation. Observed delivery vectors include cracked software, fake installers, malicious email attachments, drive-by download chains, and broader bundled malware campaigns. It has also been observed as a payload delivered by third-party loaders and distribution services, including campaigns abusing remote management tooling or gaming-themed lures. In some operations, RedLine was one component of a larger infection set that also established persistence, weakened defenses, enabled proxying, or deployed additional payloads.

The malware has figured prominently in the stealer-log economy. Credentials and session artifacts harvested by RedLine have been resold in underground markets and subsequently used by initial access brokers and intrusion actors. Documented downstream abuse includes compromise of corporate accounts on cloud collaboration and file-sharing platforms and use of infostealer-derived access in larger extortion and intrusion workflows. RedLine also appeared in infrastructure and panel ecosystems hosted by abuse-tolerant providers and was significant enough to be referenced in major law-enforcement disruption efforts, including the dismantling of RedLine and META infrastructure in Operation Magnus in October 2024.

Operationally, sandboxed samples attributed to RedLine have shown host discovery behavior, process enumeration, registry querying, dropped components, and suspicious memory-manipulation or injection-related activity, consistent with stealer execution chains that stage or protect payloads before exfiltration. RedLine has also been observed in campaigns linked to Russian-speaking cybercrime ecosystems and bundled operations such as Operation STANDOFF, where it contributed credential theft within a broader monetization chain.