What is RedLine Stealer? A guide for security teams.
RedLine Stealer is a Windows information stealer that Proofpoint first documented in March 2020, when a COVID-19-themed email campaign delivered it to healthcare and manufacturing organizations in the US; forum adverts for it date back to February 2020 [1]. It is sold as malware-as-a-service: affiliates buy a license and a control panel, then run their own campaigns [2] [4]. The US Department of Justice called it one of the most prevalent infostealers in the world, noting that the stolen data, known as logs, is sold on cybercrime forums and has been used in intrusions against major corporations [2]. ESET concluded that META Stealer, announced in 2022, was most probably made by the same developer [4].
How RedLine Stealer operates.
On October 28, 2024, an international operation known as Operation Magnus, coordinated with Eurojust and involving the Netherlands, the US, Belgium, Portugal, the UK and Australia, took down three servers in the Netherlands, seized two domains and retrieved a database of RedLine and META clients; two people were taken into custody in Belgium [3] [4]. US prosecutors charged Russian national Maxim Rudometov as an alleged developer and administrator [2], and in June 2025 the US State Department offered up to $10 million for information linked to him [5]. In March 2026 an alleged co-conspirator, Armenian national Hambardzum Minasyan, was extradited to the US [6].
What RedLine Stealer steals.
- Saved usernames and passwords from browsers [1] [3]
- Browser cookies, including authentication cookies that can help bypass MFA [2]
- Autofill data such as addresses, email addresses and phone numbers [3]
- Saved credit card details [1] [4]
- Cryptocurrency wallets [3]
- Data from FTP clients, instant messengers, VPN apps, Discord, Steam and other messaging applications [1] [4]
- System information such as IP address, country, hardware and installed security software [1]
How it spreads.
- Phishing emails using topical lures such as COVID-19 [1] [2]
- Malvertising, including fake sponsored ads for AI tools [2] [8]
- Fraudulent software downloads and fake Windows updates [2]
- Malicious archives disguised as game cheats, sometimes hosted on GitHub [8]
- Bundling with, or delivery by, other malware [8]
Notable events.
Proofpoint documents RedLine in a COVID-19-themed email campaign; forum adverts date from February 2020 [1].
META Stealer is announced on cybercrime forums; ESET later concludes it most probably shares RedLine's developer [4].
Operation Magnus takes down RedLine and META servers and domains on October 28, and US charges against Maxim Rudometov are unsealed [2] [3].
The US Rewards for Justice program offers up to $10 million for information linked to Rudometov [5].
Alleged RedLine co-conspirator Hambardzum Minasyan is extradited to the US and appears in a Texas court [6].
Flare reports RedLine log volume roughly tripled in the 90 days after Operation Magnus [7].
If an employee device was infected.
Stolen session cookies can let an attacker skip passwords and MFA, so a password reset alone is not enough.
- Isolate the infected device and reimage it; old cracked RedLine builds may still function after the takedown, so do not assume an infection is harmless [4].
- Reset every password saved in browsers and password stores on the device, from a clean machine, prioritizing email, SSO, VPN and admin accounts.
- Revoke all active sessions and tokens for affected users, because stolen authentication cookies can be replayed to bypass MFA [2].
- Review identity provider and SaaS sign-in logs for logins from new devices or locations, new MFA registrations, mailbox forwarding rules and unexpected OAuth consents.
- Rotate VPN profiles, FTP credentials, API keys and cloud secrets that were stored on the device.
- Check whether the employee accessed work accounts from personal devices, which often hold saved corporate passwords outside IT's control.
- Monitor for the affected credentials appearing in stealer logs, since stolen data is sold on criminal forums [2].
Is RedLine Stealer still active?
Its infrastructure was disrupted by Operation Magnus in October 2024 [3], but the malware has not disappeared. ESET noted that old cracked copies might still work [4], and Flare reported that RedLine log volume roughly tripled in the 90 days after the operation [7].
Who created RedLine Stealer?
US prosecutors charged Russian national Maxim Rudometov as an alleged developer and administrator of RedLine [2]. He is believed to be in Russia, and the US offered up to $10 million for related information [5]. The charges are allegations.
Can RedLine bypass multi-factor authentication?
It can help attackers do so. According to US authorities, RedLine steals authentication cookies, which can let criminals bypass MFA by reusing a logged-in session [2].
What is the difference between RedLine and META Stealer?
ESET found that most of META's code is identical to RedLine's and that both were most probably made by the same person; the two were developed in parallel and taken down together in October 2024 [4].
Research behind this guide.
By the Vuxep team. Reviewed October 19, 2026. Products, plans, and threat activity change; check the original source for current details.
- Proofpoint: New RedLine Stealer Distributed Using Coronavirus-themed Email Campaign (March 16, 2020)
- IRS Criminal Investigation (DOJ release): U.S. joins international action against RedLine and META infostealers (October 29, 2024)
- Eurojust: Malware targeting millions of people taken down by international coalition (October 29, 2024)
- ESET WeLiveSecurity: Life on a crooked RedLine: Analyzing the infamous infostealer's backend (November 8, 2024)
- The Register: Uncle Sam puts $10M bounty on RedLine dev and Russia-backed cronies (June 6, 2025)
- CyberScoop: Alleged RedLine infostealer conspirator extradited to US (March 25, 2026)
- Flare: Real-World Impact of Takedowns on the Infostealer Market (September 25, 2026)
- FortiGuard Labs: Redline Stealer threat actor profile
Compare infostealer families.
Find stolen work
credentials first.
Vuxep indexes credentials from stealer logs and alerts your team when accounts on your verified domains appear. See the workflow in a walkthrough.