In recent months, Australia has seen a surge in cyber incidents targeting some of the most trusted financial institutions, including superannuation funds and banking platforms. Behind many of these attacks lies a stealthy and highly effective tool: infostealers.
These malicious programs don’t lock systems or announce themselves with ransom demands. Instead, they quietly infiltrate devices, siphon off sensitive data, and pave the way for larger breaches — all without the victim even realising.
What Are Infostealers?
Infostealers are a type of malware designed specifically to harvest sensitive information from infected systems. This can include:
- Banking credentials
- Superannuation login details
- Saved passwords from web browsers
- Email accounts and authentication tokens
- Digital wallet information
- Browser cookies and session tokens
Once collected, this information is either sold on the dark web or used directly by attackers to commit fraud, perform identity theft, or gain deeper access into corporate networks.
The Australian Connection
Several recent breaches in Australia’s financial sector are believed to have started with infostealers. Here’s how:
Initial compromise: A user unknowingly downloads a malicious file (often via phishing emails, fake software, or cracked tools).
Data exfiltration: The infostealer extracts credentials and session cookies, including those used to access banking and superannuation accounts.
Credential stuffing: Attackers reuse these credentials across platforms, exploiting reused passwords or active sessions.
Fraud and exploitation: Super funds are drained, banking accounts are accessed, and sensitive identity data is leveraged in further attacks.
A number of superannuation platforms have recently reported unauthorised access incidents linked to compromised credentials — not due to any flaw in the platform itself, but because attackers were logging in as legitimate users.
Why Infostealers Are So Dangerous
Silent operation: Most users never know they’ve been compromised.
Bypass MFA: Session cookies and tokens can allow attackers to bypass Multi-Factor Authentication (MFA).
Mass scale: Infostealers like RedLine, Raccoon, and Vidar can infect thousands of devices in days.
Easy to buy: These tools are readily available on the dark web for low prices, making them attractive to cybercriminals.
Prevention and Protection
To safeguard individuals and organisations against infostealers, especially in the financial and superannuation space:
For Individuals:
Use unique, strong passwords for every account
Enable MFA wherever possible
Avoid downloading cracked software or unknown files
Regularly check for unfamiliar devices or logins on financial accounts
Use password managers with breach monitoring features
For Organisations:
Implement endpoint protection that detects infostealers and suspicious behaviours
Educate employees on phishing and social engineering
Monitor for abnormal login activity, such as logins from unusual geographies or devices
Consider passkey-based authentication to reduce reliance on passwords
Regularly review and audit access logs and employee device security
Final Thoughts
Infostealers represent a growing threat that blends simplicity with effectiveness. In Australia’s current cyber landscape, where attackers increasingly target superannuation and banking platforms, the real danger isn’t a system being locked — it’s being quietly watched.
Taking proactive steps now by implementing a detection and response tool like Holocron Sentry can prevent a silent breach from turning into a financial and reputational nightmare.
