AI
Screenshots Reveal the Infection Story
Information stealer malware takes a screenshot of the victim’s desktop during infection. Threat actors added this feature to bypass sandboxes and verify real users. For defenders, the screenshot is a goldmine of context. Flare collected 150 million stealer logs. 15 million of them contain a screenshot. Each image shows the browser tab, download links, file names, and the software being cracked. An analyst can reconstruct the entire infection chain from a single screenshot. The problem: 15 million images is too many for manual review.
Two-Layer LLM Pipeline Decomposes Analyst Intuition
Estelle Ruellan first tried a single LLM layer that performed both visual assessment and infection vector extraction. It failed. LLMs cannot handle two distinct tasks disguised as one. The solution: split the pipeline. Layer one describes what the screenshot shows — scene, files, links, tabs, suspicious elements. Layer two takes that description and outputs the infection vector and theme. This decomposition mirrors how human analysts work: first observe, then interpret. The prompts had to be precise instructions, not general requests. Analyst intuition had to be translated into explicit rules.
Structuring Prompts for Visual Analysis
The first layer prompt categorizes screenshots into three classes: web-based, file system/installer, or hybrid. For each class, the LLM extracts four elements: scene description, files or programs involved, any links, and browser tabs with notifications. A fifth element flags suspicious content for the second layer. Testing on 1,000 screenshots showed 96% accuracy for scene description, 100% for file explorers and links, and 85% for suspicious element identification. Browser tab identification scored only 30%. The team deleted the browser tab section entirely; overall accuracy did not suffer.
IOC Verification Separates Live from Dead
The second layer outputs infection vector and theme, producing a URL that often leads to the malware. But many URLs were dead links. Flare built an IOC verification step. URLs are categorized into three groups: file-sharing platforms, YouTube videos, and everything else. File-sharing sites respect HTTP status codes, so dead links are easy to filter. YouTube videos need deeper inspection: if the video is available, the description often contains a download link. Malicious links behind passwords or social-engineering walls are still kept as “themes” useful for campaign tracking. Only live download links become actionable IoCs.
Real Campaigns: Midjourney and Blitz Java
Two campaigns dominated the data. The Midjourney campaign used a fake website promoted via Google Ads. The site conditioned users to disable antivirus. Victims downloaded an executable that never ran, but by then the stealer had already infected the machine. The Blitz Java campaign used a nearly identical copy of the official Java website. Screenshots showed victims across multiple countries. All infections occurred within 19 hours, spanning February 11–12 — a weekend. Threat actors chose that timing to maximize leisure PC use and delay response. The campaign infected hundreds of victims.
Strengths, Limitations, and Cost
Screenshots are resilient to code changes. Packers and signature updates do not hide the infection context. As long as a screenshot exists, Flare can analyze it regardless of the malware family. The approach has limits: no screenshot means no analysis, and low-quality screenshots (desktops with icons, no active windows) yield no IoCs. Cost is low. Each log costs $0.003 and takes 5–10 seconds of OpenAI API processing. The broader challenge: 12 million stealer logs circulate, making this a systemic problem akin to the exploit kit era.
Q&A
Could a browser extension detect these fake pages in real time? Cost and timing make it prohibitive for now. ▶ 42:40
Did any campaigns bundle real software with the malware? A few video and music editing downloads included legitimate functionality, but not mainstream products. ▶ 43:37
Have you considered batch processing to speed up the LLM inference? OpenAI API limits are the bottleneck; parallelization is possible with services like Bedrock. ▶ 44:21
Do you scrape links from YouTube or Instagram directly? The IOC checking step already follows YouTube description links to find download buttons; that path is part of the JSON output. ▶ 45:42
Notable Quotes
it’s more like you’re taking a selfie in at the crime scene Estelle Ruellan · ▶ 3:24
LLMs and humans don’t think nor act the same way Estelle Ruellan · ▶ 7:05
wash your hands, never disable AV Olivier Bilodeau · ▶ 39:27
Don’t feel threatened by it. Feel enhanced by it. Olivier Bilodeau · ▶ 39:52
Key Takeaways
- LLMs replicate analyst intuition when broken into precise subtasks.
- Information stealer screenshots provide free, resilient threat intel.
- Campaigns like Blitz Java exploit mainstream software and weekend timing.
About the Speaker(s)
Olivier Bilodeau, a principal researcher at Flare, brings 15+ years of infosec expertise in honeypot operations, binary reverse-engineering, and RDP interception. He has spoken at BlackHat, DEFCON, SecTor, Derbycon, and other conferences, and co-organizes MontréHack, serving as NorthSec’s President and Hacker Jeopardy runner.
Estelle Ruellan is a Threat Intelligence Researcher at Flare with a background in Mathematics and Criminology. She has presented at ShmooCon 2025, Hack.lu 2024, eCrime APWG 2024, and EUROCRIM 2023. She designed the two-layer LLM pipeline and its prompt engineering.