In our collection, posts containing the stealer family name “Vidar” fall from 1,271 in January to 320 in February and 71 in March. Read alone, that looks like a family fading. The retained posts say otherwise.
Of the 1,265 January posts naming the family that we fetched across all searches, 1,194 came from one alert bot that posted indicators of compromise. The bot stops after February. The retained distinct posts naming Vidar fall far less steeply, from 38 to 25 and 25 over the same three months.
The bot’s end explains the curve, so the curve says nothing about Vidar. That raises a better question: when a family name does appear in a retained post, what is the name doing? We read 392 such posts to find out.
The answer is that, among the retained distinct posts, a family name rarely marks the seller’s own product. It usually brands a log, or it retells the news.
Bots Wrote Most of the Early Mentions
Between January and February, the alert bot produced 2,349 fetched posts that name a family: 1,456 Vidar, 302 MacSync, 297 Lumma, 265 StealC, 22 RedLine and 7 PureLogs. That is 59.7% of all fetched Vidar-naming posts and 78.2% of MacSync’s. The bot column is zero from March on.
| Name | Raw term posts, Jan / Feb / Mar | Retained distinct posts, Jan / Feb / Mar | Alert-bot posts naming it, Jan / Feb / Mar |
|---|---|---|---|
| Vidar | 1,271 / 320 / 71 | 38 / 25 / 25 | 1,194 / 262 / 0 |
| MacSync | 256 / 51 / 17 | 0 / 0 / 1 | 253 / 49 / 0 |
| Lumma | 332 / 149 / 64 | 16 / 4 / 3 | 258 / 39 / 0 |
A monitoring rule that counts the raw term would have reported a collapse in all three. For Vidar, the retained count falls far less than the raw term does (38 to 25, not 1,271 to 71).
Lumma’s retained count falls from 16 to 3, about as steeply as its raw count (332 to 64). Only for Vidar do the retained counts hold up. Raw counts of a family name follow the bots that carry it.
Eight Jobs a Name Can Do
For each of 17 names we drew up to 40 distinct retained posts, spread across months, and read them. Where fewer existed we read them all. We coded each post by the job its name did.
- Product offered: the stealer, its panel or its source is sold, rented or shared.
- Log-origin label: the name tags logs, a cloud or a sample for sale.
- Capability list: the name is one entry on a checker’s or a tool’s supported list.
- News or takedown relay: the post retells news, research, an indictment or an indicator report.
- Discussion: guides, opinions and questions.
- Buyer request, same-word noise and other.
For the four largest names, 160 posts were read.
| Name | Product offered | Log-origin label | News relay | Discussion |
|---|---|---|---|---|
| Lumma | 1 | 6 | 15 | 10 |
| RedLine | 4 | 10 | 4 | 10 |
| Vidar | 2 | 19 | 6 | 4 |
| StealC | 3 | 16 | 11 | 3 |
| All four | 10 (6.2%) | 51 (31.9%) | 36 (22.5%) | 27 (16.9%) |
Only 6.2% of the 160 posts offered the product, with a 95% interval of 3.4% to 11.1%.
That is a descriptive share of the sampled retained posts: cleaning removed repeated seller ads as repeated templates, and Blackhole is Telegram-dominated. Close to a third used the name to tag logs. Across 329 posts for 15 names, once same-word noise and a remote-access tool are set aside, the shares are 10.3% product offered, 28.0% log-origin label and 31.0% news relay. The remaining posts are tool lists, discussion, buyer requests and noise.
Vidar Tags Logs; Lumma Gets Retold
The four names do different work. For Vidar and StealC, labelling logs is the largest single role: 19 of 40 and 16 of 40 posts tag logs for sale. RedLine splits evenly between labelling and discussion at 10 each. Lumma is mostly something people retell or discuss, with 25 of 40 posts in those two roles against 10 of 40 for Vidar.
Read this as a descriptive gap in these samples. We chose the comparison after reading the posts, so its Fisher exact test (p about 0.0014) does not test a hypothesis set in advance. We make no causal claim. The data cannot say why one name is retold and another is used as a tag.
The offer catalogue agrees at a broader level. Vidar is named in 80 of 267 offer-like log-supply posts and in 2 of 28 rental posts.
Where a large name does head a rental, the ad can be terse. One post offers a named stealer for $239 and states neither a period nor what is delivered (IS-O004). Another puts three names under one monthly price and leaves open whether the price covers one or all (IS-O006).
Newer Names Arrive as News
The pattern flips for the newer names. AMOS or Atomic, MacSync, Amatera and PureLogs together supplied 68 posts. Of these, 58 (85.3%) were news relays: 21 of 24, 16 of 17, 18 of 24 and 3 of 3. These names reach the collection almost only as retellings of research and takedown reports.
That is not evidence that they are not sold. Blackhole is Telegram-dominated, and sellers may advertise where the collection does not reach. The same sampling limit applies here: the frame says nothing about how often an ad was reposted.
Same Word, Different Thing
Some names are ordinary words, so a keyword rule picks up other products. In the posts read, 39 of 40 containing “Lunex” were unrelated to stealers. Four of 24 “Amatera” posts were cloud-provider adverts. Among the candidate posts for the offer catalogue, 27 were car adverts in which “Redline” is a trim level.
XWorm is a remote-access tool, not an infostealer, and 13 of its 23 posts offered it as a product.
Counting it would lift a product share. Stealerium shows 20 of 21 posts as product offered, but only 3 text templates sit behind the 21 posts, one of them a mixed tool menu. Mystic shows 18 of 19 log labels, mostly short replies to one forum thread (5 templates). The pooled figures above leave out Lunex and XWorm for this reason.
Where a Name Labels, It Cannot Attribute
A name on a log post is the seller’s word.
The notification feed in what 92,000 stealer posts in January really were shows how little a label can carry. Every one of 3,429 sampled posts had the same label and the same status. A cloud ad may name three families without saying which produced which log (IS-O032). A log-derived pack can credit several families at once: IS-O017 sources recovery phrases from logs of several stealer families.
Tool lists add another use. A crypter advert can name stealer families as compatible payloads (IS-O040), and 27 of the 329 posts (8.2%) used a name only as an entry on such a list. In these posts the name describes what the tool works with, not what the poster runs.
What an Exposure Alert Should Take From a Family Name
A threat-intelligence team that sees “Lumma logs” or “Vidar cloud” in an alert has three decisions to separate.
- Remediation. Reset credentials and revoke sessions for exposed accounts without waiting to confirm the family. The name does not show how the data was taken.
- Attribution. Treat the name as a tag on the data. As an implication, not something these posts show, a host scan for that family’s indicators can come out clean while the exposure is real.
- Trend. A quiet or busy month for a name in posts can reflect bots, retellings and same-word noise. These data do not measure infections. Keep retained distinct posts as the series and drop notification bots from it.
For the commercial side of the same data, see what stealer sellers actually package. Dark web monitoring keeps these distinctions when it records the role of the name, not only its presence. The Infostealers research edition collects the catalogue and the other investigations.
