Infostealer
Malware that harvests credentials, cookies, and session tokens from infected devices, then sells them. A major driver of recent account-takeover and session-theft growth.
Infostealers changed the economics of account takeover: the credential is stolen once from an endpoint and resold repeatedly, often working years later because nobody rotated it. They also take session cookies, which is why the theft survives a password reset and defeats MFA that was only enforced at login. The Snowflake campaign is the canonical case, built entirely on infostealer logs against accounts without MFA.
See also: token theft, session hijacking, account takeover, Snowflake 2024 credential attacks
Related on Start with Identity
- GlossaryPassword Spraying
Trying a few common passwords across many accounts to avoid lockouts. Effective against weak password policies and accounts without MFA. Spraying is designed to
- GlossaryCredential Stuffing
An attack that replays username and password pairs leaked from other breaches against a target, exploiting password reuse. Defended with MFA, passkeys, and bot
- GlossaryLateral Movement
How an attacker moves from an initial foothold to other systems and accounts, often abusing identity and trust relationships. A primary target of identity threa
- TechniqueInfostealer credential harvesting
Commodity malware on an endpoint reads whatever the browser and OS have stored in the clear or under a key the same machine already holds, then ships it to a ma