Open-source infostealer projects have quietly moved from proof-of-concept repos to a core part of real-world attack chains. They speed up the spread of new techniques, lower the skill required to run them, and appear directly in the exposure data we see at Lunar. For security teams, that means every “educational” stealer or bypass PoC is now a potential production incident.
Open-source projects help infostealer operators in three main ways:
- Removing the barrier to entry with ready‑made modules for browser decryption, token theft, staging, exfiltration, and anti‑analysis. This enables lower‑skill actors to run a working infostealer with little to none original engineering.
- Compressing the time between a new defensive control appearing and a reliable bypass being used in the wild. This is because the hardest research steps are already implemented and documented.
- Increasing malware diversity. Once a proof of concept is public, different actors can fork it, rebrand it, swap exfiltration channels, and generate many detection‑resistant variants with minimal changes.
Recent work on families like VoidStealer, Stealerium, and Phemedrone shows this clearly. Public PoCs and “educational” tools end up as the backbone of real infostealer operations rather than staying in the lab.
Why Infostealers Fit Public Code So Well
Infostealers are built from reusable parts, making them a natural fit for public code. A typical infostealer only needs:
- Collection modules for browsers
- Wallets
- Messaging apps
- Games and files,
- A staging layer to organize results
- An exfiltration method
- Basic anti‑analysis and evasion logic.
None of these components need to be innovative to generate revenue. They just have to work reliably inside many different environments. Threat actors can take an open‑source infostealer with these building blocks put together and change the branding, adjust targeting, add a preferred exfiltration route, and go live much faster than writing everything from scratch.
This is why security vendors now report that criminals explicitly choose code from GitHub and similar platforms. It is easy to adopt, modify, and extend, while the result is not one family but many related variants, which are harder to track and block according to name alone.
Chrome’s ABE: From Defense To Bypass
Chrome’s Application‑Bound Encryption (ABE) is a good example of how this plays out in practice.
Google introduced ABE in Chrome 127 on Windows to bind browser secrets to an application identity rather than just to the user context. The goal was to raise the bar compared to the older DPAPI model, where any process running as the logged‑in user could decrypt browser‑protected data, which for a moment, looked like a clear win against commodity infostealers. Then bypass tooling appeared.
Researchers published ABE‑bypass techniques, some of which were released as public PoCs, which automated things like launching a browser, attaching a debugger, finding a point in memory where data is decrypted, and extracting a key.
VoidStealer is one of the clearest examples of that research turning into crimeware. It has been described as the first infostealer seen using a debugger‑based ABE bypass in the wild, pulling Chrome’s master key directly from browser memory with hardware breakpoints and no privilege escalation or code injection. This method was adopted from a public project often cited as ElevationKatz, whose documentation already walks operators through the flow and its benefits.
In practice, this is what happens when R&D is compressed into a few commands. One team solves a hard problem while everyone else gets the shortcut.
Stealerium And Phemedrone: After GitHub
Stealerium is documented as stealing browser cookies and credentials, VPN data, crypto wallets, Wi‑Fi passwords, documents, and source code, with exfiltration over Discord, Telegram, Gofile, SMTP, and Zulip. While it started as free open‑source malware on GitHub, labeled “for educational purposes only,” researchers soon observed more Stealerium‑based malware used by cybercriminals.
Code analysis found heavy overlap between Stealerium and Phantom Stealer, and suggested Warp Stealer also borrowed code, with some samples even referencing both Phantom and Stealerium internally. This is why open‑source stealers scale so efficiently: actors can keep the collection logic and simply customize exfiltration and delivery to avoid existing detections.
We see a similar story with Phemedrone. While it was available on GitHub, with support for data theft from Chrome, Discord, Steam, and multiple wallets, the repository and account eventually disappeared. However, development continued on Telegram and other private channels, showing that once code has been cloned, mirrored, or built into private tools, removing a single repository does not end the lineage.
Where Open Source Helps Attackers The Most
The risk of open-source code goes far beyond providing complete, ready‑to‑run infostealers. It helps attackers at several layers:
- Technique packaging: PoCs take a hard problem and turn it into a reusable implementation with a clear workflow, as ElevationKatz did for Chrome key extraction.
- Evasion primitives: Some ABE‑bypass projects expose userland hook bypass, direct syscalls, hollowing, and in‑memory execution, giving operators easy ways to bypass EDR.
- Data‑source plugins: Stealerium’s wide coverage of browsers, chat apps, gaming platforms, wallets, and sensitive file types shows how public collectors become a batch of components.
- Exfiltration adapters: Built‑in connectors for Discord, Telegram, Gofile, SMTP, and other services reduce the need for custom C2 and blend traffic into everyday SaaS usage.
- Builders and configuration: Public builders and clear configuration schemas lower the skill bar so that semi‑technical actors can run campaigns without deep Windows or reverse‑engineering skills.
Disclaimers like “for educational purposes only” do not change that reality. Once working theft, exfiltration, or evasion code is public, malicious operators can and will use it.
What This Means For Defenders
For defenders, the key shift is to stop treating these as isolated families and start thinking in terms of techniques and supply chains.
Once a bypass technique is public, do not wait to see it at scale before you react. For browser theft in particular, it makes more sense to track behaviors that persist across families than to focus on names and hashes that change quickly. Examples include unusual access to browser memory from non‑browser processes, debugger attachment to Chromium processes on production systems, hidden or headless browser launches with abnormal flags, and odd use of exfiltration APIs like Discord and Telegram from background processes.
This is one of the reasons why we built Lunar as an open breach and infostealer exposure monitoring platform. When a new variant slips past controls, the stolen data is sold, shared, or reused by multiple actors. By continuously monitoring leaked credentials, session cookies, and other infostealer artifacts tied to your domains, Lunar helps you spot when public code has been turned against you. It also gives you a way to rotate credentials, invalidate sessions, and cut off attackers before they reach full account takeover.
Previous post