Infostealer Malware: How Attackers Steal Enterprise Credentials in 2026

Infostealer logs exposed 1.8 billion enterprise credentials in 2024 alone, an 800% increase over 2020 figures. An infostealer is credential-harvesting malware that copies saved passwords, session tokens, and cloud API keys from an infected endpoint and sends them to an attacker-controlled server, typically within seconds of execution. It does not encrypt files, does not demand a ransom, and rarely triggers an alert. The first sign of infection is often a breach notification from a SaaS vendor.

This guide is written for IT administrators, security engineers, and SOC analysts who need to understand what infostealers take, how they take it, and which controls cut that exposure in a managed enterprise environment.

How Infostealers Work: The Extraction Chain

Modern infostealers follow a consistent four-stage process.

Stage 1: Delivery

The malware reaches the endpoint through one of several vectors. Phishing emails with malicious attachments remain the most common. Trojanised software installers distributed through search-optimised fake download pages have grown sharply since 2023. Malicious npm and PyPI packages affect developer machines specifically, targeting .env files and SSH keys. CISA's advisory AA24-190A documented a campaign in 2024 using fake browser update prompts to deliver Redline Stealer across managed enterprise networks.

Stage 2: Extraction

Once on the endpoint, the stealer accesses credential stores using Windows API calls that do not require administrator privileges on many default configurations. Common extraction targets include:

• Chrome, Edge, Firefox, and Brave saved password databases (using the browser's own decryption APIs)
• Browser session cookies, which allow attackers to replay authenticated sessions and bypass MFA entirely
• Saved credentials from Windows Credential Manager and macOS Keychain
• SSH private keys in ~/.ssh/
• AWS credentials in ~/.aws/credentials and ~/.aws/config
• Environment variable files (.env) containing database passwords, API tokens, and SaaS keys
• Slack, Discord, and GitHub tokens cached on disk

The full extraction cycle runs in under two seconds on a modern endpoint. Data is compressed and sent to the command-and-control server before the user notices anything.

Stage 3: Sale and Weaponisation

Harvested logs are sold on underground marketplaces within hours of collection. A single corporate log containing valid Okta, Salesforce, and GitHub tokens can sell for $10 to $500 depending on the organisation's size. CISA's 2025 advisory on initial access brokers documented that infostealer logs are now the primary sourcing mechanism for ransomware operators conducting pre-attack reconnaissance.

Stage 4: Account Takeover

The buyer replays the session cookies in an isolated browser instance, gaining access to business email, cloud consoles, and internal tools without entering a password or completing an MFA challenge. Most enterprise SaaS applications trust a valid session cookie for 8 to 24 hours by default.

Why Standard MFA Does Not Fully Protect Against Infostealers

This is the control failure that surprises most security teams. SMS and TOTP-based MFA protect against password-only attacks. They do not protect against session token theft.

When a user completes an MFA challenge, the application issues a session cookie. The infostealer copies that cookie. The attacker imports it into their browser. The application sees a valid, already-authenticated session and grants access without prompting for credentials or a one-time code.

The NCSC states: "Phishing-resistant MFA, specifically FIDO2 hardware security keys, is the only authentication method that binds the session to the originating device and resists credential relay and session hijacking attacks." TOTP apps and push notifications offer no protection once the session token has been exfiltrated.

Enterprise-Specific Targets: What Infostealers Prioritise on Corporate Networks

Consumer-focused infostealers target banking passwords and personal email. Enterprise-grade campaigns go deeper.

Developer workstations are the highest-value targets. A single infected developer machine can expose production database passwords, signing keys, and cloud root credentials that took months to provision.

Infostealer Families Active in 2026

The threat landscape evolves quickly, but these families account for the majority of enterprise infections observed in incident response engagements through mid-2026:

• LummaC2: Primarily delivered via malicious GitHub repositories and trojanised cracked software. Targets browser credentials, crypto wallets, and two-factor authenticator seeds. Highly evasive with frequent code updates.
• Redline Stealer: Available as a service for approximately $150/month. Targets Chrome-family browsers, FTP credentials, and VPN configurations. Still among the most active infostealers despite several operator takedowns.
• Vidar: Often bundled with malvertising campaigns. Notable for targeting gaming credentials and Telegram sessions alongside corporate passwords.
• Raccoon Stealer v2: Returned in 2023 after its operator's arrest. Marketed to less-technical threat actors; widely deployed in initial access broker operations.
• StealC: Emerged in 2023, based on Vidar and Raccoon code. Targets browser credentials, Telegram, Discord, and authenticator applications stored on disk.

Controls That Reduce Enterprise Infostealer Exposure

No single control eliminates the risk. The following layered approach addresses the most common extraction paths.

1. Disable Browser-Based Credential Storage Across All Managed Endpoints

Infostealers almost universally target browser saved password databases because they are easy to access and reliably contain valuable credentials. Disable saved passwords via Group Policy (Windows) or MDM configuration profile (macOS, iOS, Android). The relevant Chrome policy is PasswordManagerEnabled set to false. For Edge, use PasswordManagerEnabled in the Edge Administrative Templates.

This forces users into a dedicated password manager, which stores credentials in an encrypted vault that infostealers cannot access with standard API calls.

2. Deploy an Enterprise Password Manager on All Endpoints

A centralised password manager removes credentials from browser stores, shared spreadsheets, and plain-text notes. For teams already using cloud SaaS, NordPass Business provides zero-knowledge encrypted storage with admin-managed vaults, group sharing controls, and activity logging for compliance purposes. Credentials stored inside a password manager vault are not accessible to standard infostealer extraction techniques because they require both the vault decryption key and the master password.

3. Enforce Short Session Timeouts on High-Value Applications

A stolen session cookie is only useful for as long as that session remains valid. Default session lifetimes on many enterprise SaaS applications are 8 to 24 hours. Reducing them to 30 minutes for admin consoles and 4 hours for standard user sessions limits the exploitation window. Most identity providers, including Okta, Microsoft Entra, and Ping Identity, allow per-application session timeout policies.

4. Deploy Endpoint Detection and Response with Credential Access Monitoring

Modern EDR platforms, including CrowdStrike Falcon, Microsoft Defender for Endpoint, and SentinelOne, include behavioural detections that flag processes making suspicious calls to Windows DPAPI (the API browsers use to decrypt saved passwords) or reading sensitive directories like ~/.aws/. These detections are tuned specifically for infostealer behaviour patterns. Alert triage for DPAPI abuse should be treated as high severity.

5. Transition Admin Accounts to Hardware Security Keys

FIDO2 WebAuthn hardware keys (YubiKey, Google Titan, or Feitian) bind each authentication event to the physical device and the originating domain. Even if an infostealer copies a session cookie, a FIDO2-protected subsequent authentication step cannot be replayed from a different machine. Priority accounts for hardware key enforcement: cloud console root/admin, identity provider admin, CI/CD platform admin, and any service account that manages production secrets.

6. Apply Least-Privilege Access to Developer Machines

Developer workstations consistently carry the highest concentration of valuable secrets. Restricting which cloud credentials are available on development machines, rotating service account tokens automatically, and auditing which environment variables contain production secrets all reduce the blast radius of a single infected endpoint. CISA's Secure Software Development Framework recommends that developers never have persistent access to production credentials, using short-lived tokens generated at runtime instead.

• Browser credential storage disabled via policy on all managed devices
• Enterprise password manager deployed and enforced for all staff
• Session timeouts configured at 30 minutes for admin, 4 hours for standard users
• EDR with DPAPI and credential-access behaviour detections active
• Hardware security keys enforced for all privileged accounts
• Developer machines audited for persistent production credentials
• Incident response runbook includes immediate session revocation for suspected infostealer events

Incident Response: What to Do When an Infostealer Is Found

Speed matters. The average time between infostealer execution and log sale on underground markets is under six hours, according to SpyCloud research published in March 2025.

1. Isolate the endpoint immediately. Remove it from the network before starting forensic analysis. Do not simply quarantine the malware and leave the machine active.
2. Revoke all sessions across every identity provider. Force sign-out on Okta, Entra ID, Google Workspace, and any other SSO platform. Rotating passwords alone is insufficient if session cookies are already in attacker hands.
3. Rotate all long-lived credentials accessible from that machine. This includes AWS access keys, GitHub personal access tokens, database passwords, VPN credentials, and any API keys stored in environment variable files or configuration directories.
4. Review access logs for the 72 hours prior to detection. Infostealers run fast, but attackers may have been inside applications for days before the malware was detected on the endpoint.
5. Notify affected SaaS vendors. Most enterprise SaaS providers have an abuse or security team that can flag the account for additional monitoring during your recovery window.

IBM's Cost of a Data Breach 2024 report found that organisations with an incident response plan and IR team retainer contained credential breaches 54 days faster than those without, reducing average breach cost by $1.49 million.

The Role of a Password Manager in Infostealer Defence

Password managers are one of the few controls that directly block a primary infostealer extraction path. When credentials are stored only inside an encrypted vault rather than a browser database, the malware cannot access them with standard Windows DPAPI calls. The vault encryption key is derived from the master password, which the infostealer has not captured unless the user typed it into the browser at the moment of infection.

For enterprise deployments, NordPass Business supports Active Directory provisioning, admin-managed shared vaults, and audit logs that help demonstrate credential governance during a post-incident review. The zero-knowledge architecture means that even a compromise of NordPass's servers would not expose your team's stored credentials.

Frequently Asked Questions

What is infostealer malware?

Infostealer malware is credential-harvesting software that silently copies passwords, session cookies, cloud keys, and API tokens from a compromised endpoint before exfiltrating them to an attacker-controlled server. It operates without encrypting files or showing visible symptoms. Common 2026 families include LummaC2, Redline Stealer, Vidar, Raccoon Stealer v2, and StealC.

How do infostealers get onto enterprise endpoints?

The most common routes are phishing emails with malicious attachments, trojanised software installers from fake download pages (often ranking highly in search results for cracked software), malicious npm or PyPI packages targeting developer machines, and fake browser update prompts. CISA documented the fake update delivery method in advisory AA24-190A as a significant enterprise delivery vector in 2024.

Does MFA protect against infostealers?

SMS and TOTP-based MFA do not protect against session token theft. An infostealer can copy a valid session cookie after authentication has already completed, allowing the attacker to replay the session without entering a password or one-time code. FIDO2 hardware security keys are the only MFA method that binds authentication to the originating physical device, making stolen session tokens unusable from an attacker's machine.

What enterprise data do infostealers prioritise?

Identity provider session tokens (Okta, Entra ID), cloud console credentials and API keys (AWS, Azure, GCP), code repository tokens (GitHub, GitLab), CI/CD pipeline secrets, VPN credentials, and the master password for any password manager stored in a secondary browser. Developer workstations are the highest-value targets because they typically hold production secrets alongside personal credentials.

What is the fastest way to reduce enterprise infostealer exposure?

Disable browser credential storage via Group Policy or MDM policy, deploy an enterprise password manager so credentials are never in browser databases, enforce short session timeouts on cloud and identity provider consoles, and deploy EDR with credential-access behavioural detections. These four changes directly block the most common extraction paths used by every major infostealer family active in 2026.

Related Reading