Glossary
Cybercrime glossary
Plain-language definitions for infostealers, stolen credentials, ransomware precursors, and the threat intelligence concepts security teams need to operationalize.
A
-
Attacks
Account Takeover
When an attacker gains control of a legitimate user account and uses that access for fraud or further intrusion.
Read definition -
Threat Intel
Advanced Persistent Threat (APT)
A well-resourced, often state-backed adversary that maintains long-term, stealthy access to targeted networks.
Read definition -
Attacks
Adversary-in-the-Middle (AiTM)
A phishing technique that proxies a victim's login in real time to steal credentials and session tokens, bypassing MFA.
Read definition -
Attacks
AI Agent Security
Security risks from AI agents and assistants, including infostealer infections targeting AI configurations.
Read definition -
Infostealers
Atomic macOS Stealer
A macOS-focused infostealer sold to criminals, proving that Apple endpoints are active targets in the stealer economy.
Read definition -
Defense
Attack Surface Monitoring
Continuous discovery and monitoring of internet-facing assets and exposures that attackers could exploit.
Read definition
C
-
Attacks
ClickFix
A social engineering technique that tricks users into pasting malicious PowerShell commands via fake browser prompts.
Read definition -
Threat Intel
Cloud Threat Intelligence
Threat intelligence focused on attacks against cloud infrastructure, identities, and SaaS environments.
Read definition -
Credentials
Compromised Credentials
Usernames, passwords, or session tokens that attackers have obtained and can use to access accounts or systems.
Read definition -
Credentials
Cookie Hijacking
Extracting authentication cookies from a browser to bypass login flows and access protected web applications.
Read definition -
Credentials
Credential Intelligence
Actionable data about stolen, leaked, or compromised authentication credentials relevant to your organization.
Read definition -
Credentials
Credential Stuffing
Automated login attempts using username and password pairs stolen from one site against many other services.
Read definition -
Credentials
Credential Theft
The act of stealing usernames, passwords, or authentication tokens to gain unauthorized access to accounts.
Read definition -
Attacks
Cyber Reconnaissance
The information-gathering phase where attackers map a target's systems, people, and weaknesses before striking.
Read definition -
Threat Intel
Cyber Threat Intelligence
Evidence-based information about threats that helps security teams prevent, detect, and respond to attacks.
Read definition -
Threat Intel
Cybercrime Intelligence
Intelligence focused on cybercriminal actors, infrastructure, and markets rather than nation-state espionage alone.
Read definition -
Threat Intel
Cybercrime Investigation
The process of tracing cybercriminal activity, collecting evidence, and identifying perpetrators or their infrastructure.
Read definition
D
-
Dark Web
Dark Web Forums
Online communities where cybercriminals trade stolen data, tools, and access, often hidden behind registration walls.
Read definition -
Dark Web
Dark Web Monitoring
Tracking criminal forums, markets, and leak sites on Tor and related networks for threats to your organization.
Read definition -
Defense
Data Breach Detection
Identifying when sensitive organizational or customer data has been exposed or stolen.
Read definition -
Attacks
Data Exfiltration
Unauthorized transfer of sensitive data out of an organization's systems to attacker-controlled infrastructure.
Read definition -
Defense
Data Leak Detection
Identifying when an organization's data appears in breaches, leaks, or criminal markets so teams can respond.
Read definition -
Threat Intel
De-anonymization
Using technical evidence to strip anonymity from cybercriminals and link them to real infrastructure or identities.
Read definition -
Defense
Digital Forensics and Incident Response (DFIR)
The combined practice of investigating security incidents and collecting digital evidence to understand and contain them.
Read definition -
Attacks
Distributed Denial of Service (DDoS)
An attack that overwhelms a service with traffic from many sources to make it unavailable to legitimate users.
Read definition -
Attacks
Domain Spoofing
Registering domains that resemble a legitimate brand to conduct phishing or fraud.
Read definition
I
-
Threat Intel
Identity Intelligence
Intelligence about compromised, abused, or at-risk digital identities across your organization.
Read definition -
Defense
Identity Threat Detection and Response
Security controls focused on detecting and stopping attacks that use stolen or abused identities and credentials.
Read definition -
Defense
Incident Response
The structured process of containing, investigating, and recovering from a cybersecurity incident.
Read definition -
Threat Intel
Indicator of Compromise
Artifacts like IP addresses, file hashes, or domains that suggest a system or network has been breached.
Read definition -
Threat Intel
Infostealer Intelligence
Threat intelligence derived from monitoring infostealer infections, logs, and the criminal markets that trade them.
Read definition -
Infostealers
Infostealer Malware
Malware built to harvest passwords, cookies, and session tokens from infected devices and ship them to criminal operators.
Read definition -
Attacks
Initial Access Brokers
Cybercriminals who specialize in obtaining and reselling footholds into corporate networks to other attackers.
Read definition
L
-
Credentials
Leaked Credentials Monitoring
Continuous surveillance for your organization's credentials appearing in breaches, logs, and criminal markets.
Read definition -
Infostealers
Lumma Stealer
A subscription-based infostealer sold on Russian-language forums, popular for cookie theft and session hijacking.
Read definition
M
-
Infostealers
macOS Infostealer
Infostealer malware built specifically to harvest credentials and data from Apple macOS systems.
Read definition -
Infostealers
Malware Spreading Campaigns
Coordinated operations to distribute malware at scale through fake downloads, ads, and compromised sites.
Read definition -
Infostealers
Meduza Stealer
A newer infostealer family whose developers were targeted in a major Russian law enforcement operation.
Read definition
P
R
-
Infostealers
Raccoon Stealer
A MaaS infostealer that extracts browser and application credentials, historically sold through dedicated criminal storefronts.
Read definition -
Attacks
Ransomware
Malware that encrypts or exfiltrates data to extort payment, often enabled by credentials stolen via infostealers.
Read definition -
Attacks
Ransomware as a Service
A criminal business model where ransomware operators lease their malware and infrastructure to affiliate attackers.
Read definition -
Defense
Ransomware Readiness
The policies, tools, and practices that prepare an organization to prevent or survive a ransomware attack.
Read definition -
Infostealers
RedLine Stealer
A widely distributed infostealer family sold on cybercrime forums, known for harvesting browser credentials and crypto wallets.
Read definition
S
-
Credentials
Session Hijacking
Stealing or replaying a valid web session cookie to impersonate a logged-in user without needing their password.
Read definition -
Defense
SIEM Threat Intelligence
Enriching security information and event management platforms with external threat data for better detection.
Read definition -
Attacks
Smishing
Phishing carried out through SMS or messaging apps to trick victims into revealing credentials or installing malware.
Read definition -
Attacks
Social Engineering
Manipulating people into revealing information, installing malware, or taking actions that compromise security.
Read definition -
Defense
Software Supply Chain Security
Protecting the software development pipeline from malicious code injection and compromised dependencies.
Read definition -
Defense
Source Code Leak Monitoring
Detecting exposed source code, API keys, and developer secrets in public repositories and criminal channels.
Read definition -
Infostealers
Stealer Logs
Structured dumps of credentials, cookies, and system metadata exported from an infostealer-infected device.
Read definition -
Attacks
Supply Chain Attack
An attack that targets an organization by compromising a vendor, partner, or software dependency.
Read definition
T
-
Dark Web
Telegram Monitoring
Surveillance of cybercrime Telegram channels where stealer logs, breached data, and hacking tools are distributed.
Read definition -
Defense
Third-Party Risk
The security risk introduced by vendors, partners, and service providers who access your systems or data.
Read definition -
Threat Intel
Threat Actor Profiling
Building a picture of who is behind an attack, including their tools, infrastructure, motives, and partners.
Read definition -
Defense
Threat Exposure Management
A framework for continuously finding and prioritizing exposures across identities, assets, and third parties.
Read definition -
Threat Intel
Threat Intelligence for Financial Services
Threat intelligence focused on banks, fintech, and crypto, where attackers follow the money.
Read definition -
Threat Intel
Threat Intelligence for Healthcare
Threat intelligence tailored to the healthcare sector, which faces high-impact breaches and ransomware.
Read definition -
Threat Intel
Threat Intelligence Platform
A centralized system for aggregating, correlating, and distributing threat intelligence across security tools.
Read definition
V
-
Infostealers
Vidar Stealer
An infostealer family often distributed through cracked software and spam campaigns, focused on browser credential theft.
Read definition -
Defense
VIP Monitoring
Tracking cyber threats targeting executives and other high-value individuals in your organization.
Read definition -
Threat Intel
Vulnerability Intelligence
Information about software vulnerabilities and how attackers exploit them to prioritize patching and defense.
Read definition
See it in the real world
Every term connects to Hudson Rock research.
Check whether your domain already appears in stealer logs.