The Patching Friars' AlmanacA calendar of CVE saints
RedLine StealerHoly card for d-redline, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 cookie RedLine Stealer CRUSTULA RAPTA
🤖 Image and text generated with AI

⬇ Download holy card: ·

Embed on your site

Circle VI · Banking trojans and infostealers

The Demon RedLine, Password Thief for Hire

Legend

Sold as a service since 2020, RedLine is an infostealer that harvests browser passwords and cookies, cryptocurrency wallets and system data, later resold to take over accounts or open the way for ransomware. It travelled through phishing, malvertising and fake software, and was among the most widespread of its kind. In October 2024 Operation Magnus, led by the Dutch police with the FBI, Eurojust and other partners, took over its servers, and the US charged its alleged developer Maxim Rudometov.

Exorcism

Cast it out by avoiding pirated software and downloads pushed by dubious ads. Keep passwords not in the browser but in a password manager, with MFA on, and after an infection revoke every session, because stolen cookies open doors even without a password.

Technical record

Also known as
RedLine
Circle
Circle VI · Banking trojans and infostealers
First seen
2020
Status
Exorcised (Operation Magnus, 2024-10-28)

An infostealer sold as malware-as-a-service since 2020 that harvests browser passwords, cookies, crypto wallets and system data. It was one of the most widespread stealers, spread via phishing, malvertising and fake software. Operation Magnus, led by Dutch police with the FBI, took over its servers in October 2024 and the US charged alleged developer Maxim Rudometov.

Sources: attack.mitre.org · justice.gov · MITRE ATT&CK reference S1240

© The MITRE Corporation. ATT&CK® information is reproduced and distributed with the permission of The MITRE Corporation.

📅 Add to your calendar

Saints:Google CalendarApple, Outlook and others (.ics)

Observances (feasts, scourges and miracles):Google CalendarApple, Outlook and others (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.