Infostealer
Malware that harvests credentials, cookies, and session tokens from infected devices, then sells them. A major driver of recent account-takeover and session-theft growth.
Infostealers changed the economics of account takeover: the credential is stolen once from an endpoint and resold repeatedly, often working years later because nobody rotated it. They also take session cookies, which is why the theft survives a password reset and defeats MFA that was only enforced at login. The Snowflake campaign is the canonical case, built entirely on infostealer logs against accounts without MFA.
See also: token theft, session hijacking, account takeover, Snowflake 2024 credential attacks
Related on Start with Identity
- GlossaryPassword Spraying
Trying a few common passwords across many accounts to avoid lockouts. Effective against weak password policies and accounts without MFA. Spraying is designed to
- GlossaryAdversary-in-the-Middle (AitM)
Adversary-in-the-middle (AitM, written AiTM by MITRE) is an attack in which the attacker positions itself between two parties, such as a user and a sign-in serv
- GlossaryCredential Stuffing
An attack that replays username and password pairs leaked from other breaches against a target, exploiting password reuse. Defended with MFA, passkeys, and bot
- TechniqueInfostealer credential harvesting
Commodity malware on an endpoint reads whatever the browser and OS have stored in the clear or under a key the same machine already holds, then ships it to a ma
- BlogOkta found 1,843 unexpired AI session tokens sitting in a single infostealer dump
Okta analysed a 7GB infostealer dump from 5,871 machines and found 44,791 JWTs, 1,843 of them still unexpired on release day, plus 24 live API keys for Gemini,