When people think of infostealer malware, they think of the malware itself: Lumma, Vidar, StealC, Atomic Stealer. But malware does not spread on its own. Behind most infections is a group of people whose full-time job is getting it onto as many computers as possible. In the criminal underground, they are called traffer teams.
Traffer teams are the sales and distribution department of the infostealer economy. They build fake download sites, upload fake tutorial videos, buy malicious ads and send fake job offers, then hand the resulting stolen data to buyers. Understanding how they work explains why stolen credentials keep flowing onto the dark web no matter how many malware families are disrupted.
What Are Traffer Teams?
The word "traffer" comes from "traffic". Traffers drive victims' web traffic toward malicious content, usually a download that installs an infostealer. A traffer team is an organised group of these distributors working under a leader who supplies the malware, the infrastructure and the targets.
The model grew up in underground cybercrime forums and Telegram channels, and it works like an affiliate marketing scheme: the team leader provides the "product" and tools, members compete to generate installs, and everyone is paid for results. Because members need little technical skill, many are young and new to cybercrime, trained by the team in how to run campaigns.
How a Traffer Team Is Organised
The team SpyCloud studied in 2023 was led by an administrator who wanted to grow from five members to 56: 46 people building malicious sites every day and 10 creating content for them. His target was at least 5,000 downloads a day and 15,000 victim clicks a day.
How Traffer Teams Make Money
Paying per infection
Inside the team, results are counted in "installs", meaning infected computers. SpyCloud's research found the team paying roughly $0.75 to $1.66 per install, depending on the worker and the malware, and buying bulk installs from pay-per-install services at around $0.80 to $0.90 each.
Selling the logs
Each infection produces a log full of passwords, cookies and other data. Teams sell these logs in several ways:
- Individually, on automated dark web markets where buyers search by website or domain.
- As subscriptions through Telegram "log clouds", where buyers pay for a constant stream of fresh logs. Outpost24 found prices ranging from about $35 a week to $80 a month, with lifetime access sold for around $666.
- As high-value access, where corporate logins are separated out and sold to initial access brokers or used directly.
The Lures Traffers Use
- Cracked software and key generators. Fake download sites for paid software, often reached through a chain of redirects ending in cheap domains such as .click or .xyz.
- YouTube tutorials. Videos promising free software, game cheats or "cracks", with the malware link in the description.
- Malicious search ads. Paid ads that look like official download links for popular tools.
- GitHub repositories. Fake projects for game cheats and exploits with convincing, sometimes AI-generated, descriptions.
- Fake job and collaboration offers. Direct messages on social media inviting influencers, gamers or developers to test an app or join a project.
- Fake meeting or game apps. Branded-looking apps that victims are told to install for a "call" or "beta test".
- ClickFix pages. Fake CAPTCHAs that trick users into running a command that installs the stealer.
Many lures target people who often download tools from unofficial sources. If they use the same computer for work, or save work passwords in that browser, a game cheat download can expose corporate accounts.
Two Traffer Operations Up Close
The SpyCloud team (2023)
SpyCloud Labs followed one traffer team between June and early September 2023. In that time it caused well over half a million infections worldwide. Most came from LummaC2, with nearly half a million infections, followed by Raccoon (about 78,000), StealC (over 54,000) and Vidar (about 23,000). The team's administrator was reportedly based in Ukraine, and Russia was notably absent from its targets.
Marko Polo (2024)
Recorded Future's Insikt Group exposed a much larger operation called Marko Polo, which researchers describe as running its own traffer teams. It ran 30 different scam campaigns using 50 malware payloads, targeting both Windows and macOS. Lures included fake job offers and project collaborations sent to cryptocurrency influencers, gamers and developers, along with fake meeting and game apps impersonating brands such as Zoom and Fortnite. On Windows it delivered StealC and Rhadamanthys, and on macOS Atomic Stealer. Insikt estimated tens of thousands of devices compromised and millions of dollars in criminal revenue.
From Traffer to Dark Web Market
This division of labour is why disrupting one stealer rarely reduces the overall volume of stolen credentials. When Lumma was disrupted in 2025, traffer teams simply switched to other stealers. The distribution machine kept running.
Why Businesses Should Care
- Personal devices hold work logins. Employees often log into email, SSO or VPN on home computers shared with family members who download games and cracks.
- Developers are targeted directly. Fake GitHub projects and collaboration offers aim at people who hold source code access, API keys and cloud credentials.
- Logs are searched by domain. Buyers can filter markets for logs containing your company's login pages, so a single infection can quickly reach someone interested in your organisation.
- Session cookies bypass MFA. Stolen cookies can let an attacker reuse a logged-in session without the password or second factor.
How to Defend Against Traffer Campaigns
- Monitor stealer logs and log clouds for your domains and employee emails. DarkThreat watches dark web markets, forums and Telegram channels and alerts you when your company's credentials appear. See DarkThreat plans.
- Reset passwords and revoke all sessions as soon as an employee appears in a log, and make sure the infected device is cleaned first.
- Block unofficial software with application allowlisting on managed devices and a clear policy against cracked or pirated tools.
- Limit work access from personal devices with conditional access and device compliance checks.
- Stop saving work passwords in browsers. Use a managed password manager.
- Train staff, especially developers, to be wary of unsolicited job offers, collaboration requests and requests to install meeting or testing apps.
Key Takeaways
- Traffer teams are organised gangs paid to distribute infostealer malware at scale.
- They are structured like affiliate businesses, with administrators, workers and suppliers, and are paid per infection.
- Lures include cracked software, YouTube videos, malicious ads, GitHub projects, fake job offers and ClickFix pages.
- Logs are sold individually or by subscription through dark web markets and Telegram log clouds.
- Because traffers switch malware easily, monitoring for your stolen credentials matters more than tracking any single stealer.
Frequently Asked Questions
What does "traffer" mean?
It comes from "traffic". Traffers direct internet traffic, meaning potential victims, toward malicious downloads and are paid for the infections that result.
Which malware do traffer teams use?
Commonly rented infostealers such as Lumma, Vidar, StealC, Raccoon and Rhadamanthys on Windows, and Atomic Stealer on macOS. They switch between them based on price, reliability and detection rates.
Are traffer teams only after crypto and gaming accounts?
No. Their lures often target gamers and crypto users, but every log contains whatever the victim had saved, including work email, VPN, SSO and cloud logins.
What is a log cloud?
A subscription service, usually on Telegram, that delivers a continuous stream of stolen infostealer logs to paying buyers.
How can a company tell if it has been affected?
Infections on personal devices are invisible to company security tools. The most reliable sign is your domain or employee credentials appearing in stealer logs, which dark web monitoring is designed to detect.
Related Resources
- Lumma Stealer After the Takedown: Is It Back?
- ClickFix Fake CAPTCHA Attacks and the Infostealer Pipeline
- Infostealer Logs: What They Contain and Why You Need to Monitor Them
- Telegram Channels Selling Leaked Credentials: What to Monitor
- Initial Access Brokers on the Dark Web: The Hidden Attack Enablers
