LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S1240: RedLine Stealer

RedLine Stealer is an information-stealer malware variant first identified in 2020.[1][2][3] RedLine Stealer is a Malware as a Service (MaaS) and was reportedly sold as either a one-time purchase or a monthly subscription service.[1][4] Information obtained from RedLine Stealer has been known to be sold on the deep and dark web to Initial Access Brokers (IABs), who use or resell the stolen credentials for further intrusions.[5][4]

EnterpriseS1240MalwareObject v1.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

RedLine Stealer matters because ATT&CK describes it as Windows information-stealer malware delivered as Malware-as-a-Service, with stolen information known to be sold to Initial Access Brokers. For leaders, the key risk is not only the infected endpoint; it is the downstream business exposure created when browser data, local files, system details, screenshots, and credentials can become fuel for follow-on intrusions.

Executive priority

Prioritize RedLine Stealer as an identity and incident-response readiness issue, not just an endpoint malware issue. Executives should ask whether the organization can quickly identify affected Windows users, revoke or rotate exposed credentials, preserve endpoint and network evidence, and prove to auditors that malware execution, persistence, discovery, collection, command-and-control, and exfiltration controls are being monitored. Budget decisions should emphasize endpoint visibility, credential hygiene, web/C2 monitoring, and playbooks for infostealer-driven account compromise.

Technical view

ATT&CK provides no official detection text for S1240, so SOC and detection engineering teams should validate coverage through its documented behavior relationships. On Windows, test visibility for malicious-file execution, cmd.exe and Lua-related execution where applicable, scheduled task creation, registry queries, local account/user/system/browser discovery, local data collection, screen capture, msiexec proxy execution, packed or encoded payloads, deobfuscation activity, web-protocol C2, web-service use, ingress tool transfer, standard-encoded C2 data, and exfiltration over C2. IR teams should treat confirmed activity as both malware containment and possible credential exposure requiring identity scoping.

Likely telemetry

  • Windows endpoint process creation and command-line telemetry
  • Windows scheduled task creation/modification events
  • Windows Registry access/query telemetry
  • File creation, modification, execution, packing/encoding indicators, and suspicious local data access
  • Browser data access indicators on endpoints

Detection direction

  • Map detections to the related ATT&CK techniques rather than relying on a single RedLine signature, because the official object does not provide detection guidance.
  • Correlate suspicious user-executed files with follow-on discovery, browser information access, local file collection, and outbound web traffic.
  • Tune for Windows LOLBin and scripting context, especially cmd.exe, msiexec.exe, scheduled tasks, registry queries, and encoded or obfuscated command/file patterns.
  • Review web traffic detections for blind spots caused by common HTTP/S or legitimate web-service use, since those channels can blend with normal activity.
  • Account for false positives from administrators, installers, software inventory tools, and legitimate scheduled tasks by requiring behavioral chains and endpoint context.

Mitigation priorities

  • Reduce user-driven execution risk with attachment/file execution controls, user awareness, and least-privilege workstation practices.
  • Harden Windows endpoints with application control, endpoint protection, and visibility for scheduled tasks, msiexec abuse, registry discovery, and command-shell activity.
  • Limit credential exposure by strengthening password management, MFA coverage, credential rotation processes, and rapid account disablement workflows after suspected infostealer activity.
  • Improve outbound network governance with proxy/DNS logging, egress controls, and review of unusual web-protocol or web-service communications from endpoints.
  • Prepare IR playbooks that combine endpoint containment, forensic preservation, credential reset, session/token review where applicable, and monitoring for follow-on access attempts.
Additional notes and limits

The most decision-useful context is RedLine Stealer’s Malware-as-a-Service model and the ATT&CK statement that information obtained by it has been known to be sold to Initial Access Brokers. That makes the response priority broader than malware removal: defenders should assume potential downstream identity risk until local evidence proves otherwise. The object platform is Windows; several related ATT&CK techniques list broader platforms generically, but this take applies them only in the context of the supplied RedLine Stealer object.

MITRE supplies no official detection text, aliases, labels, or explicit tactics on the malware object. The behavioral guidance here is derived from the supplied relationships and descriptions only. Local validation is required to determine whether RedLine-like behavior occurred, what data was accessed, whether credentials were exposed, and whether existing controls provide sufficient coverage.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

RedLine Stealer

RedLine Stealer is an information-stealer malware variant first identified in 2020.[1][2][3] RedLine Stealer is a Malware as a Service (MaaS) and was reportedly sold as either a one-time purchase or a monthly subscription service.[1][4] Information obtained from RedLine Stealer has been known to be sold on the deep and dark web to Initial Access Brokers (IABs), who use or resell the stolen credentials for further intrusions.[5][4]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

35 rows
DomainIDNameRelationship / procedure
EnterpriseT1553.002Code SigningSub-technique

RedLine Stealer has used both valid certificates and self-signed digital certificates to appear legitimate.[1]

EnterpriseT1685Disable or Modify Tools

RedLine Stealer can disable security software and update services.[3]

EnterpriseT1033System Owner/User Discovery

RedLine Stealer has obtained the username from the victim’s machine.[2][3][4]

EnterpriseT1518.001Security Software DiscoverySub-technique

RedLine Stealer has identified installed antivirus software on the system.[5][4]

EnterpriseT1012Query Registry

RedLine Stealer can query the Windows Registry.[6]

EnterpriseT1113Screen Capture

RedLine Stealer can capture screenshots on a compromised host.[6][3]

EnterpriseT1204.002Malicious FileSub-technique

RedLine Stealer malware has been executed through the download of malicious files.[1][5][4] RedLine Stealer has also lured users to install malware with an Install Wizard interface.[6]

EnterpriseT1657Financial Theft

RedLine Stealer has collected data from cryptocurrency wallets and harvested credit cards details from browsers.[1][5][2][3][4]

EnterpriseT1087.001Local AccountSub-technique

RedLine Stealer has collected account information from the victim’s machine.[2][3]

EnterpriseT1036Masquerading

RedLine Stealer malware has masqueraded as legitimate software such as "PDF Converter Software" which has been distributed through poisoned search engine results often resembling legitimate software lures with the combination of typo squatted domains.[5]

EnterpriseT1027.002Software PackingSub-technique

RedLine Stealer has used obfuscation tools such as DNGuard and Boxed App to pack their code.[1]

EnterpriseT1614System Location Discovery

RedLine Stealer has gathered detailed information about victims’ systems, such as IP addresses, and geolocation.[1][5][2] RedLine Stealer has also checked the IP from where it was being executed and leveraged an opensource geolocation IP-lookup service. [6]

EnterpriseT1027.013Encrypted/Encoded FileSub-technique

RedLine Stealer has encrypted and encoded configuration data with Base64 and XOR functions.[3]

EnterpriseT1614.001System Language DiscoverySub-technique

RedLine Stealer can retrieve system default language and time zone.[3]

EnterpriseT1102Web Service

RedLine Stealer has leveraged legitimate file sharing web services to host malicious payloads.[2][3]

EnterpriseT1016System Network Configuration Discovery

RedLine Stealer can enumeate information about victims’ systems including IP addresses.[5]

EnterpriseT1059.011LuaSub-technique

RedLine Stealer malware has leveraged Lua bytecode to perform malicious behavior.[6]

EnterpriseT1005Data from Local System

RedLine Stealer has collected data stored locally including chat logs and files associated with chat services such as Steam, Discord, and Telegram.[1]

EnterpriseT1105Ingress Tool Transfer

RedLine Stealer has the ability download additional payloads.[5][4]

EnterpriseT1132.001Standard EncodingSub-technique

RedLine Stealer has used Base64 to encode command and control traffic.[6]

EnterpriseT1539Steal Web Session Cookie

RedLine Stealer has stolen browser cookies and settings.[1][5][2][3]

EnterpriseT1217Browser Information Discovery

RedLine Stealer can collect information from browsers and browser extensions.[3]

EnterpriseT1555Credentials from Password Stores

RedLine Stealer has obtained credentials from VPN services, FTP clients and Instant Messenger (IM)/Chat clients.[5][2][3]

EnterpriseT1555.003Credentials from Web BrowsersSub-technique

RedLine Stealer was designed to steal sensitive information from web browsers, including credit card details, saved credentials, and autocomplete data.[1] RedLine Stealer can also gather credentials from several browsers.[5][2][3]

EnterpriseT1140Deobfuscate/Decode Files or Information

RedLine Stealer has decoded its payload prior to execution.[3]

EnterpriseT1041Exfiltration Over C2 Channel

RedLine Stealer has sent victim data to its C2 server or RedLine panel server.[2]

EnterpriseT1218.007MsiexecSub-technique

RedLine Stealer has been installed via MSI Installer.[6]

EnterpriseT1082System Information Discovery

RedLine Stealer can collect information about the local system.[5][2][3][4]

EnterpriseT1071.001Web ProtocolsSub-technique

RedLine Stealer has utilized HTTP for C2 communications.[6] RedLine Stealer has also conducted C2 communications to hardcoded C2 servers over HTTPS.[1][3] RedLine Stealer has leveraged SOAP protocol for C2 communications.[2]

EnterpriseT1480Execution Guardrails

RedLine Stealer has built in settings to not operate based on geolocation or country of the victim host.[1][2]

EnterpriseT1053.005Scheduled TaskSub-technique

RedLine Stealer has achieved persistence via scheduled tasks.[6]

EnterpriseT1497Virtualization/Sandbox Evasion

RedLine Stealer has an anti-sandbox technique that requires the malware to consistently check with the C2 server, if the communication fails RedLine Stealer will not continue execution.[3]

EnterpriseT1027.010Command ObfuscationSub-technique

RedLine Stealer has obfuscated scripts within text files used in execution.[6]

EnterpriseT1059.003Windows Command ShellSub-technique

RedLine Stealer has executed windows cmd using `ErrorHandler.cmd` to create scheduled tasks.[6]

EnterpriseT1518Software Discovery

RedLine Stealer can get a list of programs on the victim device.[3]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1553.002: Code SigningEnterpriseuses · TechniqueT1685: Disable or Modify ToolsEnterpriseuses · TechniqueT1033: System Owner/User DiscoveryEnterpriseuses · TechniqueT1518.001: Security Software DiscoveryEnterpriseuses · TechniqueT1012: Query RegistryEnterpriseuses · TechniqueT1113: Screen CaptureEnterpriseuses · TechniqueT1204.002: Malicious FileEnterpriseuses · TechniqueT1657: Financial TheftEnterpriseuses · TechniqueT1087.001: Local AccountEnterpriseuses · TechniqueT1036: MasqueradingEnterpriseuses · TechniqueT1027.002: Software PackingEnterpriseuses · TechniqueT1614: System Location DiscoveryEnterpriseuses · TechniqueT1027.013: Encrypted/Encoded FileEnterpriseuses · TechniqueT1614.001: System Language DiscoveryEnterpriseuses · TechniqueT1102: Web ServiceEnterpriseuses · TechniqueT1016: System Network Configuration DiscoveryEnterpriseuses · TechniqueT1059.011: LuaEnterpriseuses · TechniqueT1005: Data from Local SystemEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1132.001: Standard EncodingEnterpriseuses · TechniqueT1539: Steal Web Session CookieEnterpriseuses · TechniqueT1217: Browser Information DiscoveryEnterpriseuses · TechniqueT1555: Credentials from Password StoresEnterpriseuses · TechniqueT1555.003: Credentials from Web BrowsersEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.0
Created
Modified
Raw hash
9db7b3a9008e1965...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.0Current bundle9db7b3a9008e…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    ESET RedLine Stealer November 2024

    Alexandre Cote Cyr. (2024, November 8). Life on a crooked RedLine: Analyzing the infamous infostealer’s backend. Retrieved September 17, 2025.

    Open source URL
  2. [2]
    Proofpoint RedLine Stealer March 2020

    Proofpoint Threat Insight Team, Jeremy H, Axel F. (2020, March 16). New Redline Password Stealer Malware. Retrieved September 17, 2025.

    Open source URL
  3. [3]
    Splunk RedLine Stealer June 2023

    Splunk Threat Research Team. (2023, June 1). Do Not Cross The 'RedLine' Stealer: Detections and Analysis. Retrieved September 17, 2025.

    Open source URL
  4. [4]
    Veriti RedLine Stealer MAAS April 2023

    Yair Herling. (2023, April 4). From ChatGPT to RedLine Stealer: The Dark Side of OpenAI and Google Bard. Retrieved September 17, 2025.

    Open source URL
  5. [5]
    Kroll RedLine Stealer August 2024

    George Glass. (2024, August 14). REDLINESTEALER Malware Driving the Initial Access Broker Market. Retrieved September 17, 2025.

    Open source URL
  6. [6]
    McAfee RedLine Stealer April 2024

    Mohansundaram M, Neil Tyagi. (2024, April 17). Redline Stealer: A Novel Approach. Retrieved September 17, 2025.

    Open source URL
  7. [7]
    ESET RedLine Stealer November 2024

    Alexandre Cote Cyr. (2024, November 8). Life on a crooked RedLine: Analyzing the infamous infostealer’s backend. Retrieved September 17, 2025.

    Open source URL
  8. [8]
    ESET RedLine Stealer November 2024

    Alexandre Cote Cyr. (2024, November 8). Life on a crooked RedLine: Analyzing the infamous infostealer’s backend. Retrieved September 17, 2025.

    Open source URL
  9. [9]
    Kroll RedLine Stealer August 2024

    George Glass. (2024, August 14). REDLINESTEALER Malware Driving the Initial Access Broker Market. Retrieved September 17, 2025.

    Open source URL
  10. [10]
    Kroll RedLine Stealer August 2024

    George Glass. (2024, August 14). REDLINESTEALER Malware Driving the Initial Access Broker Market. Retrieved September 17, 2025.

    Open source URL
  11. [11]
    Proofpoint RedLine Stealer March 2020

    Proofpoint Threat Insight Team, Jeremy H, Axel F. (2020, March 16). New Redline Password Stealer Malware. Retrieved September 17, 2025.

    Open source URL
  12. [12]
    Proofpoint RedLine Stealer March 2020

    Proofpoint Threat Insight Team, Jeremy H, Axel F. (2020, March 16). New Redline Password Stealer Malware. Retrieved September 17, 2025.

    Open source URL
  13. [13]
    Splunk RedLine Stealer June 2023

    Splunk Threat Research Team. (2023, June 1). Do Not Cross The 'RedLine' Stealer: Detections and Analysis. Retrieved September 17, 2025.

    Open source URL
  14. [14]
    Splunk RedLine Stealer June 2023

    Splunk Threat Research Team. (2023, June 1). Do Not Cross The 'RedLine' Stealer: Detections and Analysis. Retrieved September 17, 2025.

    Open source URL
  15. [15]
    Veriti RedLine Stealer MAAS April 2023

    Yair Herling. (2023, April 4). From ChatGPT to RedLine Stealer: The Dark Side of OpenAI and Google Bard. Retrieved September 17, 2025.

    Open source URL
  16. [16]
    Veriti RedLine Stealer MAAS April 2023

    Yair Herling. (2023, April 4). From ChatGPT to RedLine Stealer: The Dark Side of OpenAI and Google Bard. Retrieved September 17, 2025.

    Open source URL
  17. [17]
    mitre-attackS1240
    Open source URL
  18. [18]
    mitre-attackS1240
    Open source URL
  19. [19]
    mitre-attackS1240
    Open source URL
  20. [20]
    ESET RedLine Stealer November 2024

    Alexandre Cote Cyr. (2024, November 8). Life on a crooked RedLine: Analyzing the infamous infostealer’s backend. Retrieved September 17, 2025.

    Open source URL
  21. [21]
    ESET RedLine Stealer November 2024

    Alexandre Cote Cyr. (2024, November 8). Life on a crooked RedLine: Analyzing the infamous infostealer’s backend. Retrieved September 17, 2025.

    Open source URL
  22. [22]
    Splunk RedLine Stealer June 2023

    Splunk Threat Research Team. (2023, June 1). Do Not Cross The 'RedLine' Stealer: Detections and Analysis. Retrieved September 17, 2025.

    Open source URL
  23. [23]
    Splunk RedLine Stealer June 2023

    Splunk Threat Research Team. (2023, June 1). Do Not Cross The 'RedLine' Stealer: Detections and Analysis. Retrieved September 17, 2025.

    Open source URL
  24. [24]
    Proofpoint RedLine Stealer March 2020

    Proofpoint Threat Insight Team, Jeremy H, Axel F. (2020, March 16). New Redline Password Stealer Malware. Retrieved September 17, 2025.

    Open source URL
  25. [25]
    Proofpoint RedLine Stealer March 2020

    Proofpoint Threat Insight Team, Jeremy H, Axel F. (2020, March 16). New Redline Password Stealer Malware. Retrieved September 17, 2025.

    Open source URL
  26. [26]
    Splunk RedLine Stealer June 2023

    Splunk Threat Research Team. (2023, June 1). Do Not Cross The 'RedLine' Stealer: Detections and Analysis. Retrieved September 17, 2025.

    Open source URL
  27. [27]
    Splunk RedLine Stealer June 2023

    Splunk Threat Research Team. (2023, June 1). Do Not Cross The 'RedLine' Stealer: Detections and Analysis. Retrieved September 17, 2025.

    Open source URL
  28. [28]
    Veriti RedLine Stealer MAAS April 2023

    Yair Herling. (2023, April 4). From ChatGPT to RedLine Stealer: The Dark Side of OpenAI and Google Bard. Retrieved September 17, 2025.

    Open source URL
  29. [29]
    Veriti RedLine Stealer MAAS April 2023

    Yair Herling. (2023, April 4). From ChatGPT to RedLine Stealer: The Dark Side of OpenAI and Google Bard. Retrieved September 17, 2025.

    Open source URL
  30. [30]
    Kroll RedLine Stealer August 2024

    George Glass. (2024, August 14). REDLINESTEALER Malware Driving the Initial Access Broker Market. Retrieved September 17, 2025.

    Open source URL
  31. [31]
    Kroll RedLine Stealer August 2024

    George Glass. (2024, August 14). REDLINESTEALER Malware Driving the Initial Access Broker Market. Retrieved September 17, 2025.

    Open source URL
  32. [32]
    Veriti RedLine Stealer MAAS April 2023

    Yair Herling. (2023, April 4). From ChatGPT to RedLine Stealer: The Dark Side of OpenAI and Google Bard. Retrieved September 17, 2025.

    Open source URL
  33. [33]
    Veriti RedLine Stealer MAAS April 2023

    Yair Herling. (2023, April 4). From ChatGPT to RedLine Stealer: The Dark Side of OpenAI and Google Bard. Retrieved September 17, 2025.

    Open source URL
  34. [34]
    McAfee RedLine Stealer April 2024

    Mohansundaram M, Neil Tyagi. (2024, April 17). Redline Stealer: A Novel Approach. Retrieved September 17, 2025.

    Open source URL
  35. [35]
    McAfee RedLine Stealer April 2024

    Mohansundaram M, Neil Tyagi. (2024, April 17). Redline Stealer: A Novel Approach. Retrieved September 17, 2025.

    Open source URL
  36. [36]
    McAfee RedLine Stealer April 2024

    Mohansundaram M, Neil Tyagi. (2024, April 17). Redline Stealer: A Novel Approach. Retrieved September 17, 2025.

    Open source URL
  37. [37]
    Splunk RedLine Stealer June 2023

    Splunk Threat Research Team. (2023, June 1). Do Not Cross The 'RedLine' Stealer: Detections and Analysis. Retrieved September 17, 2025.

    Open source URL
  38. [38]
    Splunk RedLine Stealer June 2023

    Splunk Threat Research Team. (2023, June 1). Do Not Cross The 'RedLine' Stealer: Detections and Analysis. Retrieved September 17, 2025.

    Open source URL
  39. [39]
    ESET RedLine Stealer November 2024

    Alexandre Cote Cyr. (2024, November 8). Life on a crooked RedLine: Analyzing the infamous infostealer’s backend. Retrieved September 17, 2025.

    Open source URL
  40. [40]
    ESET RedLine Stealer November 2024

    Alexandre Cote Cyr. (2024, November 8). Life on a crooked RedLine: Analyzing the infamous infostealer’s backend. Retrieved September 17, 2025.

    Open source URL
  41. [41]
    Kroll RedLine Stealer August 2024

    George Glass. (2024, August 14). REDLINESTEALER Malware Driving the Initial Access Broker Market. Retrieved September 17, 2025.

    Open source URL
  42. [42]
    Kroll RedLine Stealer August 2024

    George Glass. (2024, August 14). REDLINESTEALER Malware Driving the Initial Access Broker Market. Retrieved September 17, 2025.

    Open source URL
  43. [43]
    McAfee RedLine Stealer April 2024

    Mohansundaram M, Neil Tyagi. (2024, April 17). Redline Stealer: A Novel Approach. Retrieved September 17, 2025.

    Open source URL
  44. [44]
    McAfee RedLine Stealer April 2024

    Mohansundaram M, Neil Tyagi. (2024, April 17). Redline Stealer: A Novel Approach. Retrieved September 17, 2025.

    Open source URL
  45. [45]
    Veriti RedLine Stealer MAAS April 2023

    Yair Herling. (2023, April 4). From ChatGPT to RedLine Stealer: The Dark Side of OpenAI and Google Bard. Retrieved September 17, 2025.

    Open source URL
  46. [46]
    Veriti RedLine Stealer MAAS April 2023

    Yair Herling. (2023, April 4). From ChatGPT to RedLine Stealer: The Dark Side of OpenAI and Google Bard. Retrieved September 17, 2025.

    Open source URL
  47. [47]
    ESET RedLine Stealer November 2024

    Alexandre Cote Cyr. (2024, November 8). Life on a crooked RedLine: Analyzing the infamous infostealer’s backend. Retrieved September 17, 2025.

    Open source URL
  48. [48]
    ESET RedLine Stealer November 2024

    Alexandre Cote Cyr. (2024, November 8). Life on a crooked RedLine: Analyzing the infamous infostealer’s backend. Retrieved September 17, 2025.

    Open source URL
  49. [49]
    Kroll RedLine Stealer August 2024

    George Glass. (2024, August 14). REDLINESTEALER Malware Driving the Initial Access Broker Market. Retrieved September 17, 2025.

    Open source URL
  50. [50]
    Kroll RedLine Stealer August 2024

    George Glass. (2024, August 14). REDLINESTEALER Malware Driving the Initial Access Broker Market. Retrieved September 17, 2025.

    Open source URL
  51. [51]
    Proofpoint RedLine Stealer March 2020

    Proofpoint Threat Insight Team, Jeremy H, Axel F. (2020, March 16). New Redline Password Stealer Malware. Retrieved September 17, 2025.

    Open source URL
  52. [52]
    Proofpoint RedLine Stealer March 2020

    Proofpoint Threat Insight Team, Jeremy H, Axel F. (2020, March 16). New Redline Password Stealer Malware. Retrieved September 17, 2025.

    Open source URL
  53. [53]
    Splunk RedLine Stealer June 2023

    Splunk Threat Research Team. (2023, June 1). Do Not Cross The 'RedLine' Stealer: Detections and Analysis. Retrieved September 17, 2025.

    Open source URL
  54. [54]
    Splunk RedLine Stealer June 2023

    Splunk Threat Research Team. (2023, June 1). Do Not Cross The 'RedLine' Stealer: Detections and Analysis. Retrieved September 17, 2025.

    Open source URL
  55. [55]
    Veriti RedLine Stealer MAAS April 2023

    Yair Herling. (2023, April 4). From ChatGPT to RedLine Stealer: The Dark Side of OpenAI and Google Bard. Retrieved September 17, 2025.

    Open source URL
  56. [56]
    Veriti RedLine Stealer MAAS April 2023

    Yair Herling. (2023, April 4). From ChatGPT to RedLine Stealer: The Dark Side of OpenAI and Google Bard. Retrieved September 17, 2025.

    Open source URL
  57. [57]
    Proofpoint RedLine Stealer March 2020

    Proofpoint Threat Insight Team, Jeremy H, Axel F. (2020, March 16). New Redline Password Stealer Malware. Retrieved September 17, 2025.

    Open source URL
  58. [58]
    Proofpoint RedLine Stealer March 2020

    Proofpoint Threat Insight Team, Jeremy H, Axel F. (2020, March 16). New Redline Password Stealer Malware. Retrieved September 17, 2025.

    Open source URL
  59. [59]
    Splunk RedLine Stealer June 2023

    Splunk Threat Research Team. (2023, June 1). Do Not Cross The 'RedLine' Stealer: Detections and Analysis. Retrieved September 17, 2025.

    Open source URL
  60. [60]
    Splunk RedLine Stealer June 2023

    Splunk Threat Research Team. (2023, June 1). Do Not Cross The 'RedLine' Stealer: Detections and Analysis. Retrieved September 17, 2025.

    Open source URL
  61. [61]
    Kroll RedLine Stealer August 2024

    George Glass. (2024, August 14). REDLINESTEALER Malware Driving the Initial Access Broker Market. Retrieved September 17, 2025.

    Open source URL
  62. [62]
    Kroll RedLine Stealer August 2024

    George Glass. (2024, August 14). REDLINESTEALER Malware Driving the Initial Access Broker Market. Retrieved September 17, 2025.

    Open source URL
  63. [63]
    ESET RedLine Stealer November 2024

    Alexandre Cote Cyr. (2024, November 8). Life on a crooked RedLine: Analyzing the infamous infostealer’s backend. Retrieved September 17, 2025.

    Open source URL
  64. [64]
    ESET RedLine Stealer November 2024

    Alexandre Cote Cyr. (2024, November 8). Life on a crooked RedLine: Analyzing the infamous infostealer’s backend. Retrieved September 17, 2025.

    Open source URL
  65. [65]
    ESET RedLine Stealer November 2024

    Alexandre Cote Cyr. (2024, November 8). Life on a crooked RedLine: Analyzing the infamous infostealer’s backend. Retrieved September 17, 2025.

    Open source URL
  66. [66]
    ESET RedLine Stealer November 2024

    Alexandre Cote Cyr. (2024, November 8). Life on a crooked RedLine: Analyzing the infamous infostealer’s backend. Retrieved September 17, 2025.

    Open source URL
  67. [67]
    Kroll RedLine Stealer August 2024

    George Glass. (2024, August 14). REDLINESTEALER Malware Driving the Initial Access Broker Market. Retrieved September 17, 2025.

    Open source URL
  68. [68]
    Kroll RedLine Stealer August 2024

    George Glass. (2024, August 14). REDLINESTEALER Malware Driving the Initial Access Broker Market. Retrieved September 17, 2025.

    Open source URL
  69. [69]
    McAfee RedLine Stealer April 2024

    Mohansundaram M, Neil Tyagi. (2024, April 17). Redline Stealer: A Novel Approach. Retrieved September 17, 2025.

    Open source URL
  70. [70]
    McAfee RedLine Stealer April 2024

    Mohansundaram M, Neil Tyagi. (2024, April 17). Redline Stealer: A Novel Approach. Retrieved September 17, 2025.

    Open source URL
  71. [71]
    Proofpoint RedLine Stealer March 2020

    Proofpoint Threat Insight Team, Jeremy H, Axel F. (2020, March 16). New Redline Password Stealer Malware. Retrieved September 17, 2025.

    Open source URL
  72. [72]
    Proofpoint RedLine Stealer March 2020

    Proofpoint Threat Insight Team, Jeremy H, Axel F. (2020, March 16). New Redline Password Stealer Malware. Retrieved September 17, 2025.

    Open source URL
  73. [73]
    Splunk RedLine Stealer June 2023

    Splunk Threat Research Team. (2023, June 1). Do Not Cross The 'RedLine' Stealer: Detections and Analysis. Retrieved September 17, 2025.

    Open source URL
  74. [74]
    Splunk RedLine Stealer June 2023

    Splunk Threat Research Team. (2023, June 1). Do Not Cross The 'RedLine' Stealer: Detections and Analysis. Retrieved September 17, 2025.

    Open source URL
  75. [75]
    Splunk RedLine Stealer June 2023

    Splunk Threat Research Team. (2023, June 1). Do Not Cross The 'RedLine' Stealer: Detections and Analysis. Retrieved September 17, 2025.

    Open source URL
  76. [76]
    Splunk RedLine Stealer June 2023

    Splunk Threat Research Team. (2023, June 1). Do Not Cross The 'RedLine' Stealer: Detections and Analysis. Retrieved September 17, 2025.

    Open source URL
  77. [77]
    Proofpoint RedLine Stealer March 2020

    Proofpoint Threat Insight Team, Jeremy H, Axel F. (2020, March 16). New Redline Password Stealer Malware. Retrieved September 17, 2025.

    Open source URL
  78. [78]
    Proofpoint RedLine Stealer March 2020

    Proofpoint Threat Insight Team, Jeremy H, Axel F. (2020, March 16). New Redline Password Stealer Malware. Retrieved September 17, 2025.

    Open source URL
  79. [79]
    Splunk RedLine Stealer June 2023

    Splunk Threat Research Team. (2023, June 1). Do Not Cross The 'RedLine' Stealer: Detections and Analysis. Retrieved September 17, 2025.

    Open source URL
  80. [80]
    Splunk RedLine Stealer June 2023

    Splunk Threat Research Team. (2023, June 1). Do Not Cross The 'RedLine' Stealer: Detections and Analysis. Retrieved September 17, 2025.

    Open source URL
  81. [81]
    Kroll RedLine Stealer August 2024

    George Glass. (2024, August 14). REDLINESTEALER Malware Driving the Initial Access Broker Market. Retrieved September 17, 2025.

    Open source URL
  82. [82]
    Kroll RedLine Stealer August 2024

    George Glass. (2024, August 14). REDLINESTEALER Malware Driving the Initial Access Broker Market. Retrieved September 17, 2025.

    Open source URL
  83. [83]
    McAfee RedLine Stealer April 2024

    Mohansundaram M, Neil Tyagi. (2024, April 17). Redline Stealer: A Novel Approach. Retrieved September 17, 2025.

    Open source URL
  84. [84]
    McAfee RedLine Stealer April 2024

    Mohansundaram M, Neil Tyagi. (2024, April 17). Redline Stealer: A Novel Approach. Retrieved September 17, 2025.

    Open source URL
  85. [85]
    ESET RedLine Stealer November 2024

    Alexandre Cote Cyr. (2024, November 8). Life on a crooked RedLine: Analyzing the infamous infostealer’s backend. Retrieved September 17, 2025.

    Open source URL
  86. [86]
    ESET RedLine Stealer November 2024

    Alexandre Cote Cyr. (2024, November 8). Life on a crooked RedLine: Analyzing the infamous infostealer’s backend. Retrieved September 17, 2025.

    Open source URL
  87. [87]
    Kroll RedLine Stealer August 2024

    George Glass. (2024, August 14). REDLINESTEALER Malware Driving the Initial Access Broker Market. Retrieved September 17, 2025.

    Open source URL
  88. [88]
    Kroll RedLine Stealer August 2024

    George Glass. (2024, August 14). REDLINESTEALER Malware Driving the Initial Access Broker Market. Retrieved September 17, 2025.

    Open source URL
  89. [89]
    Veriti RedLine Stealer MAAS April 2023

    Yair Herling. (2023, April 4). From ChatGPT to RedLine Stealer: The Dark Side of OpenAI and Google Bard. Retrieved September 17, 2025.

    Open source URL
  90. [90]
    Veriti RedLine Stealer MAAS April 2023

    Yair Herling. (2023, April 4). From ChatGPT to RedLine Stealer: The Dark Side of OpenAI and Google Bard. Retrieved September 17, 2025.

    Open source URL
  91. [91]
    McAfee RedLine Stealer April 2024

    Mohansundaram M, Neil Tyagi. (2024, April 17). Redline Stealer: A Novel Approach. Retrieved September 17, 2025.

    Open source URL
  92. [92]
    McAfee RedLine Stealer April 2024

    Mohansundaram M, Neil Tyagi. (2024, April 17). Redline Stealer: A Novel Approach. Retrieved September 17, 2025.

    Open source URL
  93. [93]
    ESET RedLine Stealer November 2024

    Alexandre Cote Cyr. (2024, November 8). Life on a crooked RedLine: Analyzing the infamous infostealer’s backend. Retrieved September 17, 2025.

    Open source URL
  94. [94]
    ESET RedLine Stealer November 2024

    Alexandre Cote Cyr. (2024, November 8). Life on a crooked RedLine: Analyzing the infamous infostealer’s backend. Retrieved September 17, 2025.

    Open source URL
  95. [95]
    Kroll RedLine Stealer August 2024

    George Glass. (2024, August 14). REDLINESTEALER Malware Driving the Initial Access Broker Market. Retrieved September 17, 2025.

    Open source URL
  96. [96]
    Kroll RedLine Stealer August 2024

    George Glass. (2024, August 14). REDLINESTEALER Malware Driving the Initial Access Broker Market. Retrieved September 17, 2025.

    Open source URL
  97. [97]
    Proofpoint RedLine Stealer March 2020

    Proofpoint Threat Insight Team, Jeremy H, Axel F. (2020, March 16). New Redline Password Stealer Malware. Retrieved September 17, 2025.

    Open source URL
  98. [98]
    Proofpoint RedLine Stealer March 2020

    Proofpoint Threat Insight Team, Jeremy H, Axel F. (2020, March 16). New Redline Password Stealer Malware. Retrieved September 17, 2025.

    Open source URL
  99. [99]
    Splunk RedLine Stealer June 2023

    Splunk Threat Research Team. (2023, June 1). Do Not Cross The 'RedLine' Stealer: Detections and Analysis. Retrieved September 17, 2025.

    Open source URL
  100. [100]
    Splunk RedLine Stealer June 2023

    Splunk Threat Research Team. (2023, June 1). Do Not Cross The 'RedLine' Stealer: Detections and Analysis. Retrieved September 17, 2025.

    Open source URL
  101. [101]
    Splunk RedLine Stealer June 2023

    Splunk Threat Research Team. (2023, June 1). Do Not Cross The 'RedLine' Stealer: Detections and Analysis. Retrieved September 17, 2025.

    Open source URL
  102. [102]
    Splunk RedLine Stealer June 2023

    Splunk Threat Research Team. (2023, June 1). Do Not Cross The 'RedLine' Stealer: Detections and Analysis. Retrieved September 17, 2025.

    Open source URL
  103. [103]
    Kroll RedLine Stealer August 2024

    George Glass. (2024, August 14). REDLINESTEALER Malware Driving the Initial Access Broker Market. Retrieved September 17, 2025.

    Open source URL
  104. [104]
    Kroll RedLine Stealer August 2024

    George Glass. (2024, August 14). REDLINESTEALER Malware Driving the Initial Access Broker Market. Retrieved September 17, 2025.

    Open source URL
  105. [105]
    Proofpoint RedLine Stealer March 2020

    Proofpoint Threat Insight Team, Jeremy H, Axel F. (2020, March 16). New Redline Password Stealer Malware. Retrieved September 17, 2025.

    Open source URL
  106. [106]
    Proofpoint RedLine Stealer March 2020

    Proofpoint Threat Insight Team, Jeremy H, Axel F. (2020, March 16). New Redline Password Stealer Malware. Retrieved September 17, 2025.

    Open source URL
  107. [107]
    Splunk RedLine Stealer June 2023

    Splunk Threat Research Team. (2023, June 1). Do Not Cross The 'RedLine' Stealer: Detections and Analysis. Retrieved September 17, 2025.

    Open source URL
  108. [108]
    Splunk RedLine Stealer June 2023

    Splunk Threat Research Team. (2023, June 1). Do Not Cross The 'RedLine' Stealer: Detections and Analysis. Retrieved September 17, 2025.

    Open source URL
  109. [109]
    ESET RedLine Stealer November 2024

    Alexandre Cote Cyr. (2024, November 8). Life on a crooked RedLine: Analyzing the infamous infostealer’s backend. Retrieved September 17, 2025.

    Open source URL
  110. [110]
    ESET RedLine Stealer November 2024

    Alexandre Cote Cyr. (2024, November 8). Life on a crooked RedLine: Analyzing the infamous infostealer’s backend. Retrieved September 17, 2025.

    Open source URL
  111. [111]
    Kroll RedLine Stealer August 2024

    George Glass. (2024, August 14). REDLINESTEALER Malware Driving the Initial Access Broker Market. Retrieved September 17, 2025.

    Open source URL
  112. [112]
    Kroll RedLine Stealer August 2024

    George Glass. (2024, August 14). REDLINESTEALER Malware Driving the Initial Access Broker Market. Retrieved September 17, 2025.

    Open source URL
  113. [113]
    Proofpoint RedLine Stealer March 2020

    Proofpoint Threat Insight Team, Jeremy H, Axel F. (2020, March 16). New Redline Password Stealer Malware. Retrieved September 17, 2025.

    Open source URL
  114. [114]
    Proofpoint RedLine Stealer March 2020

    Proofpoint Threat Insight Team, Jeremy H, Axel F. (2020, March 16). New Redline Password Stealer Malware. Retrieved September 17, 2025.

    Open source URL
  115. [115]
    Splunk RedLine Stealer June 2023

    Splunk Threat Research Team. (2023, June 1). Do Not Cross The 'RedLine' Stealer: Detections and Analysis. Retrieved September 17, 2025.

    Open source URL
  116. [116]
    Splunk RedLine Stealer June 2023

    Splunk Threat Research Team. (2023, June 1). Do Not Cross The 'RedLine' Stealer: Detections and Analysis. Retrieved September 17, 2025.

    Open source URL
  117. [117]
    Splunk RedLine Stealer June 2023

    Splunk Threat Research Team. (2023, June 1). Do Not Cross The 'RedLine' Stealer: Detections and Analysis. Retrieved September 17, 2025.

    Open source URL
  118. [118]
    Splunk RedLine Stealer June 2023

    Splunk Threat Research Team. (2023, June 1). Do Not Cross The 'RedLine' Stealer: Detections and Analysis. Retrieved September 17, 2025.

    Open source URL
  119. [119]
    Proofpoint RedLine Stealer March 2020

    Proofpoint Threat Insight Team, Jeremy H, Axel F. (2020, March 16). New Redline Password Stealer Malware. Retrieved September 17, 2025.

    Open source URL
  120. [120]
    Proofpoint RedLine Stealer March 2020

    Proofpoint Threat Insight Team, Jeremy H, Axel F. (2020, March 16). New Redline Password Stealer Malware. Retrieved September 17, 2025.

    Open source URL
  121. [121]
    McAfee RedLine Stealer April 2024

    Mohansundaram M, Neil Tyagi. (2024, April 17). Redline Stealer: A Novel Approach. Retrieved September 17, 2025.

    Open source URL
  122. [122]
    McAfee RedLine Stealer April 2024

    Mohansundaram M, Neil Tyagi. (2024, April 17). Redline Stealer: A Novel Approach. Retrieved September 17, 2025.

    Open source URL
  123. [123]
    Kroll RedLine Stealer August 2024

    George Glass. (2024, August 14). REDLINESTEALER Malware Driving the Initial Access Broker Market. Retrieved September 17, 2025.

    Open source URL
  124. [124]
    Kroll RedLine Stealer August 2024

    George Glass. (2024, August 14). REDLINESTEALER Malware Driving the Initial Access Broker Market. Retrieved September 17, 2025.

    Open source URL
  125. [125]
    Proofpoint RedLine Stealer March 2020

    Proofpoint Threat Insight Team, Jeremy H, Axel F. (2020, March 16). New Redline Password Stealer Malware. Retrieved September 17, 2025.

    Open source URL
  126. [126]
    Proofpoint RedLine Stealer March 2020

    Proofpoint Threat Insight Team, Jeremy H, Axel F. (2020, March 16). New Redline Password Stealer Malware. Retrieved September 17, 2025.

    Open source URL
  127. [127]
    Splunk RedLine Stealer June 2023

    Splunk Threat Research Team. (2023, June 1). Do Not Cross The 'RedLine' Stealer: Detections and Analysis. Retrieved September 17, 2025.

    Open source URL
  128. [128]
    Splunk RedLine Stealer June 2023

    Splunk Threat Research Team. (2023, June 1). Do Not Cross The 'RedLine' Stealer: Detections and Analysis. Retrieved September 17, 2025.

    Open source URL
  129. [129]
    Veriti RedLine Stealer MAAS April 2023

    Yair Herling. (2023, April 4). From ChatGPT to RedLine Stealer: The Dark Side of OpenAI and Google Bard. Retrieved September 17, 2025.

    Open source URL
  130. [130]
    Veriti RedLine Stealer MAAS April 2023

    Yair Herling. (2023, April 4). From ChatGPT to RedLine Stealer: The Dark Side of OpenAI and Google Bard. Retrieved September 17, 2025.

    Open source URL
  131. [131]
    ESET RedLine Stealer November 2024

    Alexandre Cote Cyr. (2024, November 8). Life on a crooked RedLine: Analyzing the infamous infostealer’s backend. Retrieved September 17, 2025.

    Open source URL
  132. [132]
    ESET RedLine Stealer November 2024

    Alexandre Cote Cyr. (2024, November 8). Life on a crooked RedLine: Analyzing the infamous infostealer’s backend. Retrieved September 17, 2025.

    Open source URL
  133. [133]
    McAfee RedLine Stealer April 2024

    Mohansundaram M, Neil Tyagi. (2024, April 17). Redline Stealer: A Novel Approach. Retrieved September 17, 2025.

    Open source URL
  134. [134]
    McAfee RedLine Stealer April 2024

    Mohansundaram M, Neil Tyagi. (2024, April 17). Redline Stealer: A Novel Approach. Retrieved September 17, 2025.

    Open source URL
  135. [135]
    Proofpoint RedLine Stealer March 2020

    Proofpoint Threat Insight Team, Jeremy H, Axel F. (2020, March 16). New Redline Password Stealer Malware. Retrieved September 17, 2025.

    Open source URL
  136. [136]
    Proofpoint RedLine Stealer March 2020

    Proofpoint Threat Insight Team, Jeremy H, Axel F. (2020, March 16). New Redline Password Stealer Malware. Retrieved September 17, 2025.

    Open source URL
  137. [137]
    Splunk RedLine Stealer June 2023

    Splunk Threat Research Team. (2023, June 1). Do Not Cross The 'RedLine' Stealer: Detections and Analysis. Retrieved September 17, 2025.

    Open source URL
  138. [138]
    Splunk RedLine Stealer June 2023

    Splunk Threat Research Team. (2023, June 1). Do Not Cross The 'RedLine' Stealer: Detections and Analysis. Retrieved September 17, 2025.

    Open source URL
  139. [139]
    ESET RedLine Stealer November 2024

    Alexandre Cote Cyr. (2024, November 8). Life on a crooked RedLine: Analyzing the infamous infostealer’s backend. Retrieved September 17, 2025.

    Open source URL
  140. [140]
    ESET RedLine Stealer November 2024

    Alexandre Cote Cyr. (2024, November 8). Life on a crooked RedLine: Analyzing the infamous infostealer’s backend. Retrieved September 17, 2025.

    Open source URL
  141. [141]
    Proofpoint RedLine Stealer March 2020

    Proofpoint Threat Insight Team, Jeremy H, Axel F. (2020, March 16). New Redline Password Stealer Malware. Retrieved September 17, 2025.

    Open source URL
  142. [142]
    Proofpoint RedLine Stealer March 2020

    Proofpoint Threat Insight Team, Jeremy H, Axel F. (2020, March 16). New Redline Password Stealer Malware. Retrieved September 17, 2025.

    Open source URL
  143. [143]
    McAfee RedLine Stealer April 2024

    Mohansundaram M, Neil Tyagi. (2024, April 17). Redline Stealer: A Novel Approach. Retrieved September 17, 2025.

    Open source URL
  144. [144]
    McAfee RedLine Stealer April 2024

    Mohansundaram M, Neil Tyagi. (2024, April 17). Redline Stealer: A Novel Approach. Retrieved September 17, 2025.

    Open source URL
  145. [145]
    Splunk RedLine Stealer June 2023

    Splunk Threat Research Team. (2023, June 1). Do Not Cross The 'RedLine' Stealer: Detections and Analysis. Retrieved September 17, 2025.

    Open source URL
  146. [146]
    Splunk RedLine Stealer June 2023

    Splunk Threat Research Team. (2023, June 1). Do Not Cross The 'RedLine' Stealer: Detections and Analysis. Retrieved September 17, 2025.

    Open source URL
  147. [147]
    McAfee RedLine Stealer April 2024

    Mohansundaram M, Neil Tyagi. (2024, April 17). Redline Stealer: A Novel Approach. Retrieved September 17, 2025.

    Open source URL
  148. [148]
    McAfee RedLine Stealer April 2024

    Mohansundaram M, Neil Tyagi. (2024, April 17). Redline Stealer: A Novel Approach. Retrieved September 17, 2025.

    Open source URL
  149. [149]
    McAfee RedLine Stealer April 2024

    Mohansundaram M, Neil Tyagi. (2024, April 17). Redline Stealer: A Novel Approach. Retrieved September 17, 2025.

    Open source URL
  150. [150]
    Splunk RedLine Stealer June 2023

    Splunk Threat Research Team. (2023, June 1). Do Not Cross The 'RedLine' Stealer: Detections and Analysis. Retrieved September 17, 2025.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use