Log in Request a demo

Malware profile

RedLine Stealer

RedLine Stealer is information-stealing malware that MITRE says was first identified in 2020.

In short

RedLine Stealer is information-stealing malware that MITRE says was first identified in 2020. It takes saved browser passwords, cookies, card details and cryptocurrency wallet data from infected Windows computers. It was sold to criminals as a service, and in October 2024 an international police operation took down its servers.

Last updated October 2026

Profile MapMalware
  1. Names4names in public reportsRedLine Stealer · RedLine · META
  2. Techniques16ATT&CK techniques listedCredential Access · Collection · Impact

In one minute

What it is
Information-stealing malware for Windows, sold to criminals as a service.
What it does
Steals saved browser passwords, cookies, card details and cryptocurrency wallet data, then sends it to a server the criminals control.
Who uses it
Sold to affiliates who run their own campaigns. The US Department of Justice, in October 2024 and March 2026, charged two people it alleges developed and administered it. These are allegations, not findings of guilt.
How it gets in
Fake software downloads, phishing emails, malicious adverts and sideloading, as described by the US Department of Justice.
What to do first
Turn on multi-factor authentication with hardware keys where possible, and do not let staff save passwords in browsers, as MITRE suggests.

What it does

RedLine was sold to other criminals, who ran their own campaigns with it. The US Department of Justice says affiliates bought a license and then infected their own targets. The stolen data is called “logs” and is sold on cybercrime forums.

The Department of Justice also says RedLine has been used in intrusions against major corporations. Stolen cookies and other system data can let criminals get round multi-factor authentication.

Names

Public sources use several names for this malware.

Names
NameWhere it appears
RedLine StealerMITRE ATT&CK software S1240[1]
RedLineShort name used by the US Department of Justice, the Eurojust press release and the 2026 extradition release[2, 3, 4]
METAClosely related infostealer named by the US Department of Justice and Eurojust, taken down in the same operation[2, 3]
Operation MagnusName of the October 2024 law enforcement operation against RedLine and META[2, 3]

What it can do

What MITRE ATT&CK lists this malware as doing, by tactic. Each id opens our technique page where one exists, otherwise MITRE.

Credential Access

  • Credentials from Password Stores: Credentials from Web Browsers T1555.003

    It was designed to take saved logins, card details and autocomplete data from web browsers.[1]

  • Steal Web Session Cookie T1539

    It steals browser cookies and settings. The Department of Justice says this can help criminals get past multi-factor authentication.[1, 2]

  • Credentials from Password Stores T1555

    It has taken logins from VPN services, FTP clients and chat clients.[1]

Collection

  • Data from Local System T1005

    It collects locally stored data, including chat logs and files from services such as Steam, Discord and Telegram.[1]

  • Screen Capture T1113

    It can take screenshots of the infected computer.[1]

Impact

  • Financial Theft T1657

    It collects data from cryptocurrency wallets and credit card details from browsers.[1]

Exfiltration

  • Exfiltration Over C2 Channel T1041

    It sends victim data to its command server, which MITRE also calls the RedLine panel server.[1]

Command and Control

  • Application Layer Protocol: Web Protocols T1071.001

    It has talked to its command servers over HTTP and HTTPS.[1]

  • Ingress Tool Transfer T1105

    It can download more payloads onto the infected computer.[1]

  • Web Service T1102

    It has used legitimate file sharing services to host malicious payloads.[1]

Execution

  • User Execution: Malicious File T1204.002

    It runs when a victim downloads and opens a malicious file.[1]

Persistence

  • Scheduled Task/Job: Scheduled Task T1053.005

    It has kept its foothold by creating scheduled tasks.[1]

Stealth

  • Execution Guardrails T1480

    It has built in settings that stop it running on hosts in chosen countries.[1]

  • Obfuscated Files or Information: Software Packing T1027.002

    It has been packed with obfuscation tools to hide its code.[1]

Defense Impairment

  • Disable or Modify Tools T1685

    It can switch off security software and update services.[1]

Discovery

  • Software Discovery: Security Software Discovery T1518.001

    It has looked for installed antivirus software.[1]

How it spreads

RedLine does not spread by itself. The US Department of Justice says affiliates spread it with malicious adverts, phishing emails, fake software downloads and malicious software sideloading, and that lures such as COVID-19 and Windows update themes were used. MITRE adds that it has been disguised as legitimate software such as a "PDF Converter Software" and pushed through poisoned search results. In September 2022, Security Boulevard reported a campaign that used hacked Facebook business pages: sponsored posts offered free Adobe Acrobat Reader, the link preview showed Mediafire instead of Adobe, and victims had to download the file, extract it and run it.

Timeline

  1. 2020

    First identified

    MITRE says RedLine Stealer was first identified in 2020.[1]

  2. November 2021

    Payment account registered

    The Department of Justice alleges that Hambardzum Minasyan registered a cryptocurrency account used to receive payments from RedLine affiliates.[4]

  3. 28 October 2024

    Servers taken down

    Eurojust says the takedown took place on this date. Three servers in the Netherlands were taken down, two domains seized and two people taken into custody in Belgium.[3]

  4. 29 October 2024

    Operation Magnus announced

    The US Department of Justice joined partners in announcing the disruption and unsealed charges against Maxim Rudometov, whom it describes as one of the developers and administrators.[2]

  5. 23 March 2026

    Second suspect extradited

    The Department of Justice says Hambardzum Minasyan was extradited to the United States on this date to face charges over his alleged role in developing and administering RedLine.[4]

Detection and defense

  1. Protect logins with hardware keys

    MITRE suggests hardware-based tokens such as FIDO keys, which tie a login to the real site, so stolen cookies are harder to use. The Department of Justice warns that stolen cookies can help bypass multi-factor authentication.[5, 2]

    Counters: T1539

  2. Watch sign-in activity

    Audit logins and look for impossible travel or odd behavior that could show a stolen session cookie in use.[5]

    Counters: T1539

  3. Limit passwords saved in browsers

    MITRE says organizations may weigh the risk of storing credentials in browsers, and use policy, technical controls and training to prevent it.[6]

    Counters: T1555.003 T1555

  4. Keep browsers and password managers updated

    MITRE advises regular updates to browsers, password managers and related software.[5, 6]

    Counters: T1555.003 T1539

  5. Train users on fake downloads and phishing

    The Department of Justice says RedLine spreads through fake software downloads, phishing and malicious adverts. MITRE advises training users to spot phishing.[2, 5, 1]

    Counters: T1204.002 T1539

  6. Use official detection and victim resources

    MITRE lists detection strategies for browser credential store access (DET0037) and web session cookie theft (DET0509). The Department of Justice points to the Operation Magnus website, www.operation-magnus.com, for the public and potential victims.[6, 5, 2]

    Counters: T1555.003 T1539

Questions

What is RedLine Stealer?

Information-stealing malware for Windows. MITRE says it was first identified in 2020 and was sold as a service to criminals.

What does RedLine steal?

The US Department of Justice says usernames and passwords, financial information, system information, cookies and cryptocurrency accounts. Eurojust adds saved form data such as addresses and phone numbers.

Was RedLine taken down?

In October 2024 an international operation called Operation Magnus took down servers and seized domains. Eurojust says the takedown took place on 28 October 2024 and the US Department of Justice announced it on 29 October 2024.

Has anyone been charged?

The US Department of Justice has charged Maxim Rudometov (October 2024) and Hambardzum Minasyan (extradited March 2026). These are allegations, and both are presumed innocent until proven guilty.

How can organizations reduce the risk?

Use hardware-based multi-factor authentication, audit logins for stolen session cookies, limit passwords saved in browsers and keep browsers updated, as MITRE advises.

In our research

  1. Adobe Acrobat Sign Abused in Redline Stealer Distribution Campaigns March 2023
  2. RedLine Stealer Malware Was Distributed Through the Corporate Social Media Accounts September 2022
  3. Cyber Threats to the Qatar World Cup 2022 | Brandefense January 2023
  4. Vulnerability and Malware Trends of 2022 January 2023
  5. Top 3 Stealer Malware Activity Research March 2022
  6. Infostealer Glossary term

Sources

  1. RedLine Stealer, Software S1240 MITRE ATT&CKSupports: Description, platform, first identified in 2020, techniques and the lack of listed groups.
  2. U.S. Joins International Action Against RedLine and META Infostealers US Department of Justice, Western District of TexasSupports: Operation Magnus, how RedLine was sold and spread, domain seizure and charges against Maxim Rudometov, 29 October 2024.
  3. Malware targeting millions of people taken down by international coalition EurojustSupports: Takedown on 28 October 2024, servers, domains and arrests, countries involved.
  4. Armenian Man Extradited to U.S. Faces Charges for Role in Infostealing Malware Scheme US Department of Justice, Western District of TexasSupports: Charges against Hambardzum Minasyan, extradition on 23 March 2026.
  5. Steal Web Session Cookie, Technique T1539 MITRE ATT&CKSupports: Mitigations and detection for cookie theft.
  6. Credentials from Web Browsers, Technique T1555.003 MITRE ATT&CKSupports: Mitigations and detection for browser credential theft.

Browse the threat library

Keep exploring

Knowledge Hub

Glossary term

Infostealer

An infostealer is a type of malware that copies saved passwords, browser cookies and other data from an infected device and sends it to the attacker.

Read more

Glossary term

Stealer logs

Stealer logs are bundles of data collected from an infected device by information-stealing malware.

Read more