Train on the infostealer families running the 2026 stealer-log economy: Lumma, Vidar 2.0, StealC, and the macOS stealer AMOS. Follow each from the lure that drops it to the single stolen log that takes down an enterprise.
Infostealers are a global, industrialised trade, and these are the exact families this track puts you up against. Each dot marks a country where one runs hot across 2025-26, sized and coloured by how concentrated the activity is. Pick a family to light up its hotspots, or tap a dot to read the stat behind it. This is live threat activity a SOC analyst triages today, not a history lesson, and every report behind the numbers is one click away.
Threat concentration
Infostealers are a global, industrialised trade, and these are the exact families this track puts you up against. Each dot marks a country where one runs hot across 2025-26, sized and coloured by how concentrated the activity is. Pick a family to light up its hotspots, or tap a dot to read the stat behind it. This is live threat activity a SOC analyst triages today, not a history lesson, and every report behind the numbers is one click away.
What the stealer takes and how it hides. Follow loader chains to the deployed stealer, then catch covert exfiltration over Discord webhooks, anonymous hosts, and image steganography.
From one stolen log to an enterprise breach. Trace harvested credentials into cloud data theft and extortion: the reason infostealers are the defining threat of 2026.
38 techniques across 13 tactics.
A verifiable credential awarded for completing the track.
Infostealer logs are the raw material of the 2026 breach economy: in the Snowflake campaign, roughly 80% of abused accounts had a prior stealer infection. Cheap stealer-as-a-service (Lumma, Vidar, StealC, AMOS) harvests the session cookies and credentials that bypass MFA and hand initial access to ransomware crews. Spotting a stealer early is the difference between one wiped laptop and a tenant-wide data theft.
38 techniques across 13 tactics.
