Infostealer malware is now one of the fastest routes from a personal laptop infection to a corporate breach. In 2025, IBM X-Force said more than 300,000 ChatGPT credential sets were advertised on dark web markets, while Verizon’s 2025 DBIR tied credential abuse to 22% of confirmed breaches. The fix isn’t one tool. You need fewer reusable passwords, phishing-resistant MFA, and faster detection of stolen session data.
What is infostealer malware?
Infostealer malware is malicious software built to quietly collect identity data from a device: saved browser passwords, session cookies, tokens, autofill records, crypto-wallet files, credit card details, Telegram sessions, screenshots, keystrokes, and system metadata. It doesn’t need to encrypt your files or announce itself. Silence is the feature.
The practical damage is simple. If a thief gets a valid cookie or token, they may not need your password at all, and standard MFA prompts can be bypassed in some account takeover scenarios. That’s why the old advice, “just turn on MFA,” is no longer enough on its own.
Security teams used to treat consumer malware infections as a help-desk nuisance. That view has aged badly. Google Cloud/Mandiant reported in 2024 that the UNC5537 Snowflake customer intrusions used credentials previously stolen by infostealers, turning endpoint infections into cloud data theft and extortion.
How infostealer malware turns one bad download into a breach
The chain usually starts somewhere ordinary: a cracked software installer, a malicious ad, a fake browser update, a phishing email, or a trojanized productivity tool. IBM X-Force linked the 2025 rise in phishing emails delivering infostealer malware and credential phishing to attackers using AI to scale distribution, research targets, and iterate faster.
Once installed, the stealer scrapes browser profiles and app data, then sends the stolen package to an operator. Those packages are often called “logs.” In 2025, stealer-log markets were described across security sources as selling bundles that can include saved passwords, cookies, cloud tokens, autofill data, crypto-wallet files, and device fingerprints.
Here’s the part many generic explainers miss: password uniqueness changes the blast radius. Verizon DBIR-related research in 2025 found that, among users infected with infostealer malware, the median user had only 49% distinct passwords across services. If you have 80 accounts and follow that median behavior, roughly 41 account passwords may be reused or repeated somewhere. One infected home PC can become a map of your work life.
Credential stuffing is the next step, and it’s different from brute force because attackers try known username-password pairs instead of guessing from scratch. If you need a plain-language breakdown, this guide to credential stuffing versus brute force attacks explains why reused passwords are so valuable to criminals.
The numbers behind the 2026 credential breach problem
The public figures are ugly, but you should read them with care. Reliable primary-source information on live stolen-log marketplace pricing and volumes is scarce; many numbers come from security vendors or media summaries rather than law-enforcement datasets. Still, the direction of travel is clear.
| Source and year | Reported figure | Why it matters |
|---|---|---|
| IBM X-Force, 2026 | Over 300,000 ChatGPT credential sets advertised on dark web markets in 2025 | AI service accounts are now part of the identity attack surface |
| Verizon DBIR, 2025 | 22,000+ incidents and 12,195 confirmed data breaches in the dataset | Credential abuse accounted for 22% of breaches |
| Google Cloud/Mandiant, 2024 | UNC5537 Snowflake intrusions used credentials previously stolen via infostealers | Consumer-style infections can lead to major cloud compromises |
| The Hacker News citing Flashpoint, 2026 | More than 11.1 million devices infected in 2025, feeding over 3.3 billion stolen credentials, cookies, tokens, and other identity data | Useful as a scale indicator, though vendor-sourced |
| TechRadar citing Varonis, 2026 | “Storm” infostealer priced at $900 per month | Shows how account hijacking tools are being packaged as subscriptions |
A quick calculation makes the Flashpoint-cited figure more concrete. If 3.3 billion identity records came from 11.1 million infected devices in 2025, that averages about 297 stolen items per device. That doesn’t mean every infected laptop exposes 297 working passwords. Some entries are duplicates, stale cookies, or low-value accounts. Even so, one compromised browser profile can contain years of accumulated risk.
Some of the 2026 strain reporting is especially grim. The Hacker News reported BusySnake Stealer collecting screenshots, keystrokes, cryptocurrency wallet files, Telegram session and credential data, cookies, and passwords. BleepingComputer reported FortiClient EMS CVE-2026-35616 exploitation delivering an undocumented credential stealer called EKZ. TechRadar also reported SentinelOne findings on Reaper, a SHub macOS variant targeting browsers, wallets, keychains, Telegram data, and user documents.
Why stolen cookies make MFA feel weaker than it is
Multi-factor authentication still matters. A lot. The problem is that ordinary push or code-based MFA protects the login moment, while stolen session cookies and tokens may represent a user who has already logged in. Attackers don’t always knock on the front door.
Microsoft’s 2025 guidance says phishing-resistant MFA should be deployed and can be required through Conditional Access policies. NIST SP 800-63B-4, published in July 2025, also covers password, MFA, and phishing-resistant authentication guidance. The direction is obvious: move toward passkeys, FIDO2 security keys, certificate-based authentication, or other phishing-resistant methods where the business risk justifies it.
One uncomfortable edge case: a perfectly enrolled user with a strong password and app-based MFA can still be exposed if malware steals an active browser session from an unmanaged personal device. Honestly, allowing unmanaged machines to access sensitive SaaS apps only makes sense if you can tolerate that risk or tightly limit what those sessions can do.
The same identity problem shows up in adjacent attacks. For example, warnings about Microsoft 365 MFA not being enough are really warnings about session theft, token abuse, and conditional access gaps rather than a reason to abandon MFA.
The stolen-log marketplace, explained without the drama
Stolen-log markets work because criminals don’t need to breach every target themselves. One group infects machines. Another buys logs. A third tries accounts against VPNs, SaaS platforms, crypto exchanges, banks, developer tools, and email providers. Specialization lowers the skill bar.
Reported 2026 market snapshots vary. The Hacker News cited Flashpoint analysis saying more than 30 unique infostealer strains were actively listed for sale across illicit marketplaces, forums, and underground communities. Breachsense reported in 2026 that RedLine led its observed 2025 infostealer market with 60% share and 447 million credentials. Constella reported that 78% of recently breached companies had corporate credentials appearing in infostealer logs within six months of breach.
Treat those vendor figures as signals, not court records. They’re useful for trend spotting, but they don’t all measure the same thing. A “credential” may be a password, a token, a cookie, a duplicate, a dead login, or a working enterprise account. Buyers sort the pile later.
AI makes that sorting cheaper. IBM said in 2026 that attackers are using AI to speed research, analyze large datasets, and iterate attacks faster. That lines up with what defenders are seeing elsewhere: automated triage, better phishing copy, and faster adaptation after a campaign gets blocked. For more context, read this analysis of AI agents being weaponized by hackers.
How do credentials get stolen, and what should you do first?
Start with the boring controls. They work. The NSA and CISA said in 2023 that poor credential hygiene enables initial access, persistence, and lateral movement, especially where phishing-resistant MFA is not enabled. They also advised organizations to provide or allow password managers.
Your priority order should be practical, not theatrical:
- Use a password manager and replace reused passwords, beginning with email, cloud admin, finance, developer, HR, and remote-access accounts.
- Deploy phishing-resistant MFA for administrators, executives, finance users, and anyone with access to sensitive data.
- Use Conditional Access to restrict risky locations, unmanaged devices, impossible travel, and abnormal session behavior.
- Monitor for exposed corporate credentials in stealer logs, then reset passwords and revoke sessions, not just one or the other.
- Harden browsers and endpoints: block unapproved extensions, prevent credential storage where possible, patch fast, and remove local admin rights.
- Train users on fake installers, cracked software, malicious ads, and fake CAPTCHA/download flows, not only email phishing.
Revoking sessions deserves more attention than it gets. If you reset a password but leave active sessions alive, a stolen cookie may still be useful until it expires or is invalidated. For high-risk accounts, reset credentials, revoke refresh tokens, force reauthentication, and review recent OAuth app grants.
Investigation also needs identity context, not just malware alerts. Tools and services that enrich stolen credential findings can help security teams prioritize which exposures matter first; this report on AI-assisted identity threat investigations shows why speed matters when logs circulate quickly.
Smaller companies shouldn’t copy a bank’s entire control stack on day one. A 25-person firm gets more value from password manager adoption, enforced MFA, session revocation procedures, and endpoint patching than from an expensive dashboard nobody has time to read. As organizations mature, their security priorities change; this guide to how security priorities shift with company growth is a sensible companion.
What leaders often get wrong about infostealer malware
The first mistake is treating it as an employee discipline problem. Yes, someone may have installed a shady browser extension or a cracked app. But the bigger failure is architectural: browsers are holding too much identity material, unmanaged devices have too much access, and too many services accept reusable secrets.
Another pitfall is buying dark web monitoring and calling the job done. Monitoring tells you that something may already be exposed. It doesn’t rotate secrets, revoke sessions, remove malware, or stop the same user from reusing a new password next week.
A sharper metric is “time from stolen-log alert to session invalidation.” If your security team gets a log hit at 9 a.m. and the account remains active at 3 p.m., attackers have a working day to test it. At this price of delay, even good tooling looks bad.
Don’t ignore personal devices, either. Many corporate breaches begin with credentials stolen from a home computer where an employee once logged into webmail, Slack, GitHub, a CRM, or a payroll portal. You may not manage that machine, but you can limit its access with device compliance rules, step-up authentication, and tighter session lifetimes.
FAQ
Is infostealer malware the same as spyware?
They overlap, but they aren’t identical. Spyware is a broad category for surveillance; infostealer malware is specifically built to extract valuable data such as passwords, cookies, tokens, wallets, and browser records.
Can MFA stop infostealer malware?
MFA can reduce account takeover risk, especially phishing-resistant MFA. It does not remove malware from the device, and stolen session cookies or tokens may still create risk if sessions aren’t revoked.
How do I know if my credentials are in stealer logs?
Organizations typically use identity exposure monitoring, threat intelligence services, or incident response firms to check stealer-log data. Individuals can start by changing reused passwords, enabling MFA, and reviewing account login history where services provide it.
Are Macs affected by infostealers?
Yes. In 2026, TechRadar reported SentinelOne findings on Reaper, a macOS infostealer variant targeting browsers, cryptocurrency wallets, keychains, Telegram session data, and user documents.
What should I do after an infostealer infection?
Clean or rebuild the device first, then change passwords from a trusted device, revoke active sessions, rotate tokens and API keys, check financial and email accounts, and enable phishing-resistant MFA where available.
EN 
FR 
ES