Hackers Dropping Mid-Heist Selfies

Overview: Estelle and her research colleague present a large-scale threat intelligence investigation into the post-infection artifacts generated by modern information stealer malware. The speakers examine how stealer logs distributed and monetized across underground Telegram channels contain automated desktop detonation screenshots captured during execution. The presentation details the design, benchmarking, and operational deployment of a two-stage multimodal Large Language Model (LLM) pipeline developed to extract high-fidelity indicators of compromise (IOCs) and uncover malware distribution campaigns at scale.

Key Topics: - Information stealer malware ecosystem (RedLine, Vidar, Lumma) and Telegram trade - Detonation screenshots as forensic artifacts ("mid-heist selfies") - Two-stage multimodal LLM architecture for visual threat intelligence extraction - Prompt engineering, benchmarking, and automated IOC validation heuristics - Large-scale campaign tracking: Midjourney and Blitz Java malvertising lures

Technical Details: Information stealer malware families—such as RedLine, Vidar, and Lumma—infect victim endpoints without requiring administrative privileges, harvesting stored browser credentials, cryptocurrency wallets, session tokens, and clipboard data. As an integrated sandbox evasion and victim verification mechanism, these stealers capture a full desktop screenshot at the moment of detonation. Threat actors bundle these logs into daily zip archives and resell them via subscription-based Telegram channels. Infiltrating these criminal channels allowed the researchers to curate a repository spanning over 11 million infection logs and 15 million detonation screenshots.

To analyze this massive visual dataset without manual bottlenecking, the team engineered an automated multimodal LLM pipeline. Initial attempts using a single-prompt LLM architecture failed because combining visual scene assessment with domain-specific malware attribution overloaded the model, causing hallucinations and omitted indicators. To solve this, the authors decoupled the process into two sequential LLM layers. The first layer performs objective visual feature extraction across five categories: general scene description, file explorer/installer titles, visible URLs/hyperlinks, browser tabs, and suspicious UI elements (such as password-protected zip archives, crack instructions, or AV disable prompts).

Benchmarking the visual layer across 1,000 screenshots demonstrated 96% accuracy for scene descriptions, 100% for file explorer names, and 100% for visible URLs, while browser tab identification performed poorly (30%) and was pruned without impacting downstream accuracy. The structured text output from the first layer feeds into a second LLM layer, which identifies the specific infection vector and lure theme (e.g., cracked software like Microsoft Office, Photoshop, Vegas Pro, or gaming cheats for Fortnite and Valorant). A downstream validation pipeline validates extracted URLs against HTTP status codes and platform-specific heuristics (e.g., Mega error strings and YouTube video status) to filter dead links from live C2 and distribution infrastructure. The system successfully mapped widespread malvertising campaigns leveraging Google Ads, including fake Midjourney installers and the "Blitz Java" campaign.

Key Takeaways: Decoupling multimodal LLM workflows into distinct visual perception and analytical reasoning stages effectively eliminates hallucinations in high-throughput threat intelligence processing. Automated detonation screenshots within stealer logs provide high-fidelity ground truth on initial access vectors, allowing defenders to track distribution infrastructure before public feed indexing. Security teams must monitor underground stealer log brokers to proactively revoke compromised enterprise credentials and deploy web filtering against active malvertising and YouTube crack lures.

(AI summary — Gemini Flash)