Victim profiling is the process of ranking potential targets by signals that suggest they are valuable, accessible, or useful to an attacker. Those signals can include business email accounts, saved browser credentials, privileged logins, company devices, or other signs that an endpoint is tied to an organization. In practice, profiling helps attackers decide where to focus effort instead of treating every infected system the same.
This matters because modern malware is often more than simple credential theft. An infostealer or remote access trojan can collect local data, then sort victims for follow-up activity such as account takeover, lateral movement, or deeper intrusion. For defenders, victim profiling is a warning that one compromised host may reveal which accounts and systems deserve immediate review. Response usually goes beyond deleting malware: teams should revoke sessions, rotate credentials, isolate the host, and check nearby accounts for abuse.