TL;DR: Infostealers now target browser artifacts, autofill data, screenshots, and session material because those assets often unlock identity-driven intrusions faster than traditional malware payloads, according to Sprocket Security's interview with F-Secure researcher Megan Squire. The operational lesson is that browser and endpoint hygiene are now identity controls, not just user productivity issues.
At a glance
What this is: Sprocket Security’s interview shows infostealers increasingly use browser artifacts and session material as identity-enabling loot rather than just malware payloads.
Why it matters: This matters because IAM, PAM and endpoint teams now have to treat browsers, autofill, screenshots and personal-device access as part of the identity attack surface.
Context
Infostealers are malware that harvest stored browser data, session material and other local artifacts so attackers can reuse them for account access. In practice, that collapses the boundary between endpoint compromise and identity compromise, because the browser becomes a credential and session repository rather than a neutral client.
The article frames this as a governance problem as much as a malware problem. When users mix personal and corporate activity on the same device, the organisation loses control over where identity material lives, how long it persists, and how easily it can be replayed. That is a familiar failure mode in mixed-use environments, but browser artifacts make it more operationally visible.
Key questions
Q: What breaks when browser artifacts are treated as harmless user data?
A: Browser artifacts stop being harmless when they contain reusable identity material such as cookies, autofill data, screenshots or saved sessions. That creates a replay path that can bypass normal password-based controls and speed up account takeover. Security teams should treat those artifacts as sensitive identity assets and reduce how long they remain usable on endpoints.
Q: Why do infostealers create so much risk even when MFA is enabled?
A: Infostealers are dangerous because they can steal active session tokens after authentication, which lets attackers impersonate a user without replaying a password or MFA challenge. That bypasses a major control boundary. In practice, this means MFA alone does not stop session hijacking, browser-based credential theft, or unauthorized access to cloud and corporate systems.
Q: What are the signs that browser-based identity compromise is happening?
A: Look for repeated logins from unusual devices, duplicate or overlapping sessions, unfamiliar browser fingerprints and access to internal tools shortly after suspicious downloads or endpoint infections. Those signals often indicate that a browser artifact, token or session has been harvested and replayed. The earlier teams correlate them, the faster they can contain the compromise.
Q: How should teams govern corporate access from personal devices?
A: Teams should treat personal-device access as a separate trust category with tighter conditions than managed endpoints. If users browse, download and authenticate in the same environment, infostealers can bridge consumer activity into enterprise access. Conditional access, device trust checks and limits on local credential persistence are the controls that reduce that cross-over risk.
Technical breakdown
Why browser artifacts matter to identity theft
Browser artifacts include stored passwords, autofill entries, cookies, session tokens, screenshots, and saved form data. Infostealers do not need to defeat every control when those artifacts already contain reusable identity material. The attack value comes from aggregation: one infected endpoint can reveal enough context to impersonate a user, bypass normal login friction, or reconstruct internal workflows. That makes the browser a high-yield identity cache, especially where sessions remain valid and access is loosely segmented.
Practical implication: treat browser storage, session persistence and endpoint hygiene as part of identity control design.
How infostealer logs become resale-ready identity intelligence
Infostealer operators often package stolen data into logs that can be bought, scraped, sliced and resold. The logs are valuable because they combine credentials with context, such as active sessions, target systems, and business workflows. That context helps buyers prioritize which accounts are worth replaying and which devices expose the most usable trust. The market is not just selling passwords; it is selling the operational path into a user’s identity footprint.
Practical implication: monitor for exposed artifacts as a composite identity signal, not as isolated credential theft.
Why BYOD and mixed-use browsing widen the blast radius
Bring-your-own-device scenarios increase risk when personal browsing, gaming downloads, and corporate access share the same environment. Once a device used for ordinary consumer activity also handles enterprise authentication, infostealer infection can bridge into workplace identity material without needing a direct enterprise foothold. That makes policy enforcement, device trust, and session governance inseparable. A browser on an unmanaged or weakly managed device can become the shortest route from user behaviour to enterprise compromise.
Practical implication: tighten conditional access, device trust and session boundaries for mixed-use and unmanaged endpoints.
Threat narrative
Attacker objective: The attacker wants reusable identity material that can be monetized, replayed and turned into access to corporate and personal accounts.
- Entry occurs when a user installs or executes an infostealer on a workstation or personal device, often through ordinary downloads or risky browsing behaviour.
- Credential and session material are harvested from browser artifacts, including autofill data, cookies, screenshots and other locally stored context.
- Attackers resell or reuse the stolen logs to replay sessions, access internal tools and move into the victim’s identity footprint.
- Impact follows when the stolen artifacts enable account takeover, unauthorized access to corporate systems or downstream data theft.
Breaches seen in the wild
- Schneider Electric Jira breach 2024: Credentials linked to a Lumma infostealer infection gave Hellcat access to Schneider Electric's Jira; 40GB and 400,000 user rows claimed.
- Scania insurance portal breach 2025: An attacker used an external user login, likely stolen by infostealer malware, to take insurance claim documents from a Scania portal.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Browser artifacts are now identity infrastructure by accident. Organisations still treat browser storage as a convenience layer, but infostealers have turned it into a high-density identity repository. Cookies, autofill and screenshots carry enough context to accelerate account replay even when passwords alone are not enough. The governance lesson is that identity material exists outside the IAM stack, so the control boundary has to extend into the endpoint and browser layer.
Infostealer economics are reshaping the threat model. The market value of stolen logs comes from the combination of credentials, active sessions and business context, not from malware sophistication. That changes what defenders should prioritise: visibility into identity artifacts, session lifetime and device trust matters more than chasing every commodity payload. Browser artifact leakage is therefore a measurable precursor to account compromise, not just a hygiene issue.
Crossing the streams is the named failure mode here. The article’s most important governance concept is the mixing of personal-device behaviour with corporate identity use. Once a user browses, downloads and authenticates on the same device, the organisation loses clean separation between consumer activity and enterprise trust. That failure mode should be treated as a policy and access design problem, not only a user-awareness problem.
Identity teams need to think in terms of replay surfaces, not just credentials. A stolen session token or browser artifact can be more valuable than a password because it may bypass the first authentication step entirely. That means account protection has to include session governance, device posture, and artifact containment alongside authentication strength. The practical conclusion is simple: identity assurance now depends on what the browser retains after login, not only on what the user types at login.
From our research library:
- 54% of ransomware victims had credentials exposed before the attack, according to Verizon's 2025 Data Breach Investigations Report.
What this signals
Crossing the streams is the security failure that matters most here. The risk is not simply that a device gets infected, but that consumer browsing and enterprise authentication share the same local trust boundary. Once that happens, identity governance has to cover browser persistence, session reuse and endpoint posture as one control problem rather than three separate ones.
Browser artifacts should now be treated as sensitive identity evidence because they can reveal enough context to replay access without ever stealing a password in the traditional sense. That shifts the practitioner focus toward containment, session governance and device trust, especially in mixed-use environments.
For practitioners
- Enforce browser artifact containment Limit the persistence of autofill, saved passwords and session tokens on managed endpoints, and disable high-risk browser features where business use does not require them.
- Separate personal and corporate browsing Block or tightly condition corporate access from unmanaged or mixed-use devices so personal downloads and enterprise sessions do not share the same trust boundary.
- Harden session replay resistance Shorten session lifetimes where appropriate, require step-up checks for sensitive actions, and monitor for suspicious reuse of active browser sessions.
- Detect infostealer exposure signals Watch for anomalous logins, duplicated sessions, unfamiliar device fingerprints and evidence that browser-derived credentials or tokens have been replayed.
Key takeaways
- Infostealers are turning ordinary browser storage into an access path, which makes endpoint hygiene part of identity governance.
- The most dangerous stolen material is often not the password itself but the session or context that lets an attacker reuse trust.
- Teams that want to reduce this risk need tighter browser controls, stronger device trust and shorter-lived sessions.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | Browser artifacts and infostealer logs expose credentials, tokens and session material. |
| NHI-10 — Human Use of NHI | Users mixing personal and corporate browsing create unsafe reuse of identity material across contexts. | |
| Recommendation — Scan endpoints and browsers for leaked NHI secrets and remove any reusable material immediately. Separate personal and corporate trust boundaries so users do not handle enterprise access on unmanaged devices. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | The article centres on the lifecycle of browser-stored credentials and session material. |
| Recommendation — Apply authenticator management controls to reduce persistence and reuse of browser-held identity material. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Browser replay risk turns entitlement and session governance into a core access problem. |
| Recommendation — Review access permissions and session trust assumptions for browser-mediated logins and sensitive workflows. | ||
| MITRE ATT&CK | TA0006;TA0009 — Credential Access; Collection | Infostealers collect identity material for later abuse and session replay. |
| Recommendation — Map infostealer activity to credential access and collection tactics, then hunt for replayable browser artifacts. | ||
Key terms
- Infostealer: An infostealer is malware built to collect credentials, session material, tokens, and other authentication data from infected systems. In NHI programmes, the risk is not only theft but reuse, because harvested workload secrets can unlock cloud access long after the initial infection.
- Browser Artifact: A browser artifact is any data stored or generated by a browser that can reveal user activity or support authentication, including cookies, saved passwords, history, autofill data, and synced sessions. Attackers value these artifacts because they often provide access without needing to crack a password.
- Session Replay: A technique where an attacker reuses a captured authenticated session token to act as the victim without knowing the password. In modern cloud environments, replay can bypass traditional login controls and persist until the token is revoked or naturally expires.
- Device Trust: Device trust is the confidence that a requesting endpoint is known, managed, and in a compliant state. It matters because identity alone does not prove safety. In zero trust programmes, device trust becomes one of the inputs used to decide whether access should be granted or sustained.
Deepen your knowledge
NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is designed for practitioners who need to connect access governance, lifecycle control and emerging identity risk across modern environments.
Published by the NHIMG editorial team on August 20, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org