Over the last several years, Recorded Future has seen a significant increase in the sale of credentials across marketplaces like Genesis Store, Russian Market, Amigos Market, and others. These marketplaces provide cybercriminals with quick and easy access to compromised computers and networks. The success and proliferation of these marketplaces for stolen credentials have been made possible by Infostealers. Infostealers allow threat actors to gather sensitive information from victim systems, including credentials, personally identifiable information (PII), login data, network access, and cookies, essentially allowing cybercriminals to perform an online identity takeover.In this session, we will discuss the most common techniques and tactics used by Infostealers to target public and private sector entities in our region – specifically Saudi Arabia.