The proliferation of infostealer logs has become a significant operational security challenge for organizations, moving beyond a niche underground commodity to a mainstream threat. Security teams are increasingly confronted with alerts indicating that employee corporate credentials, including email addresses and passwords for SaaS applications, have appeared in these logs. These logs often contain not only static credentials but also active browser cookies, which can enable attackers to bypass multi-factor authentication (MFA) and access live sessions.
A key challenge stems from the origin of these exposures. Approximately 46% of infostealer logs containing corporate credentials are believed to originate from unmanaged or personal devices, often hundreds of miles from corporate offices. Malware families like RedLine, Lumma, and Vidar are designed to harvest a wide array of information from infected systems, including saved browser passwords, cookies, autofill data, cryptocurrency wallets, system information, and VPN configurations. A single infection can yield hundreds or thousands of individual records, creating a massive scale problem for defenders.
The volume and nature of the data in these logs make prioritization difficult. Security analysts must distinguish between an old, potentially meaningless password for a consumer website and a fresh log containing corporate identity credentials and an authenticated browser session for an enterprise identity provider. The latter scenario, especially when combined with session cookies, presents a critical risk, as it can lead to immediate account takeover without requiring a password or MFA prompt.
Session cookies are particularly dangerous because they represent an already authenticated state. If an infostealer captures such a cookie, an attacker can replay it to gain access to an application, effectively bypassing traditional authentication steps and MFA. This means that even if a password is reset, an attacker might still maintain access through a stolen session. The exposure of credentials and sessions for major productivity SaaS and cloud services is estimated to be growing by about 29% annually.
Most infostealer logs, roughly 90%, are now found on Telegram channels, both public and private, rather than traditional underground forums. This shift makes the data more accessible to initial access brokers, ransomware affiliates, and opportunistic attackers.
Upon discovering potentially relevant infostealer data, an immediate assessment is crucial to determine the necessary reaction speed. This initial phase involves identifying what was stolen, when the infection occurred, the system involved, the number of corporate credentials present, and whether authenticated sessions were captured. Business context is also vital; a credential for a test server should not receive the same priority as one for a finance system, nor should an intern's exposed identity be treated identically to an administrator's with access to critical infrastructure.
Enterprise identity credentials combined with session cookies are considered a critical severity exposure, warranting a response target of under one hour. VPN/RDP access paired with multiple corporate credentials is classified as high severity due to its potential for lateral movement within a network.
Following the initial assessment, the next step is to determine if the stolen information has already been used. This involves correlating the exposed identity with authentication telemetry, looking for successful or failed logins from unexpected geographies, unusual devices, unfamiliar IP addresses, or access to resources outside the employee's normal behavior. Defenders must also verify if the stolen information is still usable, checking if passwords have changed, sessions have expired, or accounts are still active.
A comprehensive investigation workflow expands to include browser fingerprint information, the complete inventory of saved credentials, details about the infected system, and other artifacts like VPN configurations or SSH keys. It's important to ascertain the employee's role, their access privileges, whether the infected machine was corporate or personal, and if the incident is an isolated infection or part of a broader campaign. Authentication logs across all systems accessible to the exposed identity should be examined, prioritizing the most sensitive resources, to identify any behaviors indicative of account takeover.
