Infostealers now drive identity-first intrusion at industrial scale

At a glance

What this is: Flashpoint’s 2026 midyear threat report shows infostealers operating as a large-scale identity harvesting engine, with millions of infected devices and billions of stolen credentials collected in six months.

Why it matters: This matters because stolen credentials are now a primary path into enterprise VPNs, cloud services, SaaS and webmail, which makes identity controls, session revocation and token hygiene central to response.

By the numbers:

• Flashpoint recorded 7.4M infected hosts and devices globally in the first half of 2026.
• Flashpoint reports a 27% period-over-period increase in information-stealing malware operations.
• Flashpoint says over 22M AI-related illicit discussions appeared in underground forums.

Context

Infostealers are malware families that steal credentials, session data and browser artefacts from infected endpoints, then push that material into underground markets. In this report, Flashpoint shows that the scale of this activity has moved beyond isolated theft and into a persistent supply chain for access brokers, ransomware crews and other threat actors. The identity angle is direct: compromised logins are now a reusable attack commodity, not just a by-product of malware.

The governance gap is that many programmes still treat authentication as a one-time gate while attackers increasingly treat it as a traded asset lifecycle. That breaks older assumptions about perimeter defence, especially when stolen sessions can be replayed against VPNs, cloud services and SaaS platforms. For identity teams, the infostealer problem sits squarely at the boundary between infostealer threat guide and enterprise access control.

Key questions

Q: What breaks when attackers can reuse stolen cloud credentials in SaaS environments?

A: When stolen credentials work in SaaS, the organisation loses the assumption that authentication proves legitimacy. Attackers can inherit existing trust, enumerate data, and exfiltrate through normal interfaces without triggering malware-based controls. Defenders need identity behaviour baselines, MFA hardening, and rapid revocation of exposed tokens and sessions.

Q: Why do infostealers make session revocation more important than password resets?

A: Because attackers often use session cookies and tokens that remain valid even after a password change. If the live session is not revoked, the account can stay reachable. Effective response has to invalidate existing sessions, not only update credentials, or the attacker may retain access long enough to continue activity.

Q: What signs suggest stolen credentials are being operationalised, not just collected?

A: Look for suspicious login attempts from unusual geographies, repeated authentication against cloud and SaaS services, and evidence that exposed sessions are being tested at scale. Those indicators suggest the attacker has moved from harvesting to exploitation. The practical test is whether the compromise is appearing in authentication telemetry, not only in malware logs.

Q: How should security teams respond when a live session token appears in an underground log dump?

A: Treat it as an active identity compromise, not a future risk. Revoke the token, terminate related sessions, force credential reset where required, and review downstream access paths that may have been opened through the session. The response should be immediate because the token may already be in use.

Technical breakdown

How infostealers turn endpoints into credential harvesters

Infostealers are built to extract high-value identity artefacts from endpoints without requiring long dwell time. They collect browser-stored passwords, session cookies, autofill data, token material and sometimes local application data, then package the results for resale or automation. The operational shift in this report is that the harvested data is not sitting idle. It is fed into downstream workflows that sort, enrich and test credentials at scale. That means the endpoint is no longer just the infection point. It is the first stage of an access pipeline that converts compromise into usable identity material. See the Infostealer Threat Guide.

Practical implication: treat infected endpoints as identity compromise events, not just malware detections.

Why stolen sessions matter more than stolen passwords

A stolen password is useful, but a live session cookie or token can bypass password checks entirely until it expires or is revoked. That is why infostealer activity has outsized impact on cloud and SaaS environments, where token reuse can look like legitimate access. The report’s emphasis on active session testing shows the attacker preference clearly: if the session works, the adversary avoids noisy password-reset workflows and lands directly inside the account. This is a control failure at the authentication layer, not only a malware-detection problem.

Practical implication: shorten session lifetime and revoke tokens when underground exposure is confirmed.

How commodity malware feeds the access economy

The report describes infostealer logs as raw material for a professionalised access economy made up of marketplaces, Telegram channels and automated bot shops. In practice, that creates a repeatable chain from infection to monetisation: harvest, enrich, sell, test and exploit. Once that chain exists, defenders are no longer fighting one attacker; they are fighting a distributed service model that can scale login abuse across many environments at once. The security architecture response has to assume that credentials and sessions may be traded within hours, not days.

Practical implication: monitor external leak ecosystems as an extension of your identity attack surface.

Threat narrative

Attacker objective: The attacker wants reusable, valid access that can bypass perimeter defences and support downstream intrusion, fraud or ransomware operations.

1. Entry begins with infostealer infection on an endpoint through malware distribution, illicit marketplaces or related delivery mechanisms.
2. Credential_harvested follows as the malware extracts browser credentials, active session tokens and other identity artefacts from the host.
3. Escalation occurs when the stolen material is parsed, enriched and tested against enterprise services, enabling authenticated access at scale.
4. Impact is realised when attackers log in to VPNs, cloud applications, SaaS portals and webmail as legitimate users and use that access for intrusion or follow-on crime.

Breaches seen in the wild

• Change Healthcare breach 2024: A stolen login on a Citrix portal without MFA led to ALPHV ransomware, a $22 million ransom and 192.7 million people affected.
• Scania insurance portal breach 2025: An attacker used an external user login, likely stolen by infostealer malware, to take insurance claim documents from a Scania portal.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Infostealer logs have become an identity supply chain, not just a malware by-product. Flashpoint’s reporting shows a system where infected hosts, harvested credentials, underground marketplaces and automated testing are linked into one operational pipeline. That changes the governance problem from endpoint compromise to identity reuse across environments. Practitioners should treat exposure monitoring as part of access governance, not only threat intelligence.

Continuous token revocation is the real control boundary. Password resets alone do not solve the problem if active session tokens and cached browser artefacts remain usable. The report’s emphasis on session testing and automated response reflects a broader truth: modern identity compromise is often a session problem first and a password problem second. Security teams need to move response logic closer to token issuance and revocation.

Credential reuse pressure: the underlying failure mode is that one compromised login can unlock many services because authentication reuse is still too common. When attackers can replay identity artefacts across VPNs, SaaS and cloud consoles, the blast radius is governed by how much trust the programme places in a single set of credentials. Infostealer threat guide is the right baseline for understanding that exposure. Practitioners should reduce reusability wherever possible.

Phishing-resistant authentication is necessary, but it is not sufficient on its own. The report points toward hardware-backed authentication and continuous access evaluation as the durable response, but those controls only work when paired with rapid session invalidation and browser hardening. That means identity policy, endpoint policy and detection logic must be aligned. Practitioners should build the response chain before exposure appears, not after.

The market signal is clear: identity telemetry is becoming threat telemetry. Underground visibility, token exposure awareness and session-aware detection are moving from specialist capabilities to baseline security requirements. That does not make the malware problem go away, but it does change where defenders need to invest first. Practitioners should treat stolen-credential monitoring as a core control, not an enrichment luxury.

What this signals

Identity telemetry is becoming a core security signal. When stolen credentials and sessions are traded as commodities, the boundary between threat intelligence and identity governance collapses. Programmes need monitoring that connects underground exposure, session risk and access decisions rather than treating them as separate workflows.

Session-aware access control is now a baseline requirement. A stolen password can still be blocked, but a live token can outlast weak response workflows. Teams should expect more pressure to align identity providers, endpoint controls and response automation around token revocation instead of relying on password change events alone.

For practitioners

• Implement continuous token revocation policies Revoke active endpoint tokens and cloud sessions automatically when exposed credentials or session artefacts are identified in underground logs.
• Harden browser and endpoint credential storage Disable credential caching in enterprise browsers and review local storage of authentication artefacts on managed endpoints.
• Adopt phishing-resistant authentication Prioritise hardware-backed authentication methods for high-value accounts and remove reliance on reusable passwords where possible.
• Build external monitoring for infostealer supply chains Track marketplaces, Telegram channels and bot shops for exposed logs tied to your domains, SaaS dependencies and third-party access paths.
• Link exposure data to incident response Feed log enrichment outputs into triage so analysts can identify session cookies, host context and malware family details before resetting access.

Key takeaways

• Infostealers are now a primary identity-exposure mechanism because they collect reusable credentials and live sessions at scale.
• Flashpoint’s data shows the problem is large enough to influence how teams define access risk, response priorities and monitoring coverage.
• The control gap is not only malware detection. It is the delay between exposure discovery and the revocation of active credentials and sessions.

Related NHI Mgmt Group resources: Infostealer Threat Guide · Dark Web Monitoring Guide · Threat Intelligence Guide · Change Healthcare breach 2024

Key terms

• Infostealer: An infostealer is malware built to collect credentials, session material, tokens, and other authentication data from infected systems. In NHI programmes, the risk is not only theft but reuse, because harvested workload secrets can unlock cloud access long after the initial infection.
• Session Token Exposure: Session token exposure occurs when authentication tokens or session artifacts are stored, transmitted, or logged in places they should not be. Once exposed, they can function like reusable credentials. This makes them part of identity and access risk, not only application behaviour.
• Underground Access Economy: The underground access economy is the market structure that trades in stolen credentials, logs, session data and initial access. It connects malware operators, access brokers and downstream criminals, creating a repeatable path from endpoint compromise to monetised intrusion.
• Continuous Access Evaluation: Continuous access evaluation is the practice of rechecking whether a principal should still have access after the session begins. In NHI environments, it matters because tokens and service accounts can remain valid while the surrounding risk changes, so enforcement has to follow the request, not just the login.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, secrets management and workload identity. It helps practitioners connect identity controls to the broader security programme they run every day.