The “Russian Market” cybercrime marketplace has become a leading platform for trading credentials stolen by information stealer malware. Although it has been active for about six (6) years and gained popularity by 2022, the market’s prominence surged following the takedown of the Genesis Market, which left a void in the cybercrime landscape. Despite 85% of the credentials being “recycled” from existing sources, the marketplace attracts a large audience with its diverse offerings and low prices, with some logs available for as little as $2. Infostealer logs, typically text files generated by malware, contain a wealth of stolen information such as account passwords, session cookies, credit card data, cryptocurrency wallet information, and system profiling data. These logs can include thousands of credentials, making the total number potentially reach hundreds of millions. Once collected, the data is uploaded to an attacker’s server for further malicious activities or sale on platforms like the Russian Market. Infostealers are increasingly targeting enterprises to obtain session cookies and corporate credentials. Researchers noted that 61% of logs on the Russian Market include SaaS credentials from platforms like Google Workspace, Zoom, and Salesforce, while 77% contain Single Sign-On (SSO) credentials. These compromised accounts provide attackers with access to critical systems and sensitive data. Lumma stealer previously dominated the market, accounting for 92% of credential logs, but its operations were disrupted by a global law enforcement action that seized 2,300 domains. As a result, a new infostealer named Acreed has rapidly gained traction, with over 4,000 logs uploaded in its first week. Acreed targets data stored in browsers like Chrome and Firefox, including passwords, cookies, cryptocurrency wallets, and credit card details. Infostealers infect users via phishing emails, “ClickFix” attacks, malvertising, and videos on platforms like YouTube and TikTok. To mitigate these risks, CTIX analysts recommend vigilance and safe software download practices.