AI
Screenshots as Intelligence Sources
Information stealer malware skips administrative rights — it grabs credentials, crypto wallets, password manager contents, clipboard data, and system information from whatever it can reach. Those artifacts get packaged and sold by the day on Telegram. The stealer also takes a screenshot at detonation, originally to help operators spot sandbox environments.
That screenshot is the focus here. Flare infiltrated Telegram channels and accumulated 15 million screenshots across 11 malware families. Each one is, in the presenter’s words,
“taking a selfie of a crime scene.”
A single frame can show a YouTube tutorial with a download link still visible, a Mega archive already in the browser bar, or a file explorer full of suspicious names — all recoverable via OCR at scale.
Designing a Two-Layer LLM Pipeline
A single LLM layer failed because analysts decompose screenshot analysis into two distinct steps: visually assess what is happening, then apply field knowledge to identify the infection vector. A one-layer prompt asks the model to collapse both into a single step, producing poor results.
The two-layer architecture encodes that distinction. Layer one describes the screenshot: main content, visible files, links, and anything suspicious. Layer two receives that formatted description and identifies the vector and theme. Assessment on 1,000 screenshots showed 96% scene description accuracy, 100% on file explorer and links, 85% on suspicious elements. Browser tab identification hit only 30%, so the team deleted it. Accuracy did not change.
IOC Live/Dead Discrimination
Most IOCs extracted from screenshots were already dead. File-sharing platforms return clear HTTP error codes, so dead links are labeled immediately and filtered from the live feed. YouTube videos get the same treatment: gone is gone. When a download link has been removed from a video description (threat actors do this to avoid detection), the team stores the lure theme instead, enabling campaign tracking even without an active URL.
The live pipeline demo (17:39) fed two screenshots through the full two-layer pipeline in real time, showing LLM descriptions, extracted URLs, and dead-IOC labeling. An Office 2019 crack and an Adobe Photoshop crack both yielded vector and theme within seconds.
Attacker Lure Themes and Distribution Channels
Across tens of thousands of screenshots, two lure types dominated. Cracked software targets users willing to bypass licensing fees, and the most common titles were mainstream paid applications: Office, Vegas Pro, MidJourney, Filmora. Gaming cheats targeted Fortnite, Valorant, and Minecraft, chosen because they have frequent paid cosmetics, a young demographic without money to spend, and graphics suitable for children.
Distribution follows two patterns. YouTube tutorials present downloads as free and 100% safe, with instructions to disable antivirus embedded in the video. Google Ads let threat actors buy placement at the top of search results for targeted keywords, sometimes constrained by time window and geography. Both strategies put malicious content exactly where users expect safety.
Campaign Case Studies: MidJourney and Blitz Java
Two campaigns each exceeded 5% of all infections analyzed. MidJourney: users searching for the AI image tool got a sponsored ad above the legitimate site, clicked through to a near-perfect copy with a warning that “security software may falsely trigger,” downloaded an executable that didn’t run, then disabled their AV trying to fix it. That was the malware’s goal.
Blitz Java hit devices across multiple countries in 19 hours on February 11 to 12, a weekend timed to catch security teams off-hours and users with more free time. The Java installer copy was good enough that the team initially suspected the real Java site had been compromised. Spotting the fake required comparing button fonts, spacing, and file size side by side.
“they simply still work so well.” — Co-presenter
Q&A
What does the info stealer context mean beyond the initial attack? Extracted IOCs let corporate proxies block download URLs immediately; campaign themes enable awareness posts warning users when a specific software is being targeted; detonating unrecognized payloads and uploading to VirusTotal forces threat actors to spend more on new campaigns. ▶ 37:59
Do you report findings to authorities or platforms to get malicious content taken down? They report to platforms like YouTube and GitHub in some cases but get mostly automated responses months later; a high-signal feed for platform partners is a planned next step. ▶ 39:27
Notable Quotes
taking a selfie of a crime scene. Co-presenter · ▶ 3:01
An LLM can’t just figure it out. You have Estelle Ruellan · ▶ 7:27
they simply still work so well. Co-presenter · ▶ 31:39
Key Takeaways
- Info stealer screenshots encode infection vectors and live download links, processable at 0.3 cents per image.
- LLM pipelines require analyst intuition encoded as explicit layered instructions, one task per layer.
- Blitz Java infected devices worldwide in 19 hours across Feb 11-12; MidJourney clones ran via Google Ads.