# infostealer

Source: https://startwithidentity.com/glossary/infostealer/
Last updated: 2026-08-29
License: content by Start with Identity. Cite the source URL.

---

Malware that harvests credentials, cookies, and session tokens from infected devices, then sells them. A major driver of recent account-takeover and session-theft growth.

Infostealers changed the economics of account takeover: the credential is stolen once from an endpoint and resold repeatedly, often working years later because nobody rotated it. They also take session cookies, which is why the theft survives a password reset and defeats MFA that was only enforced at login. The Snowflake campaign is the canonical case, built entirely on infostealer logs against accounts without MFA.

See also: [token theft](https://startwithidentity.com/glossary/token-theft/), [session hijacking](https://startwithidentity.com/glossary/session-hijacking/), [account takeover](https://startwithidentity.com/glossary/account-takeover/), [Snowflake 2024 credential attacks](https://startwithidentity.com/breaches/snowflake-2024-credential-attacks/)