Phishing, infostealers, and exploit chains are converging on identity

At a glance

What this is: This is a threat roundup showing how phishing, infostealers, credential attacks, and exploit chaining are being used to steal identities and gain access.

Why it matters: It matters because IAM, PAM, and NHI teams need to see identity abuse across delivery methods, not as isolated incidents, so they can harden credentials, sessions, and remote access together.

👉 Read Anomali's Cyber Watch roundup on phishing, infostealers, and exploit chains

Context

Identity abuse is increasingly the connective tissue across otherwise different threat stories. In this roundup, attackers use social engineering, password spraying, browser theft, and exploited applications to reach the same end state: stolen credentials, valid sessions, or privileged access that can be reused downstream.

For IAM and NHI programmes, that means the control problem is not just malware detection. It is the exposure window around passwords, cookies, API keys, browser stores, and remote-access portals, plus the speed at which attackers can turn those artefacts into usable access.

Key questions

Q: How should security teams reduce breach risk from stolen credentials?

A: Security teams should reduce credential lifetime, remove stale secrets from code and tooling, and make access revocation faster than attacker reuse. The key is to assume credentials will leak and to limit what they can do once exposed. Rotation, least privilege, and detection on abnormal use all matter, but only when they are enforced consistently across human, NHI, and delegated access.

Q: Why do phishing campaigns still work even when organisations have security tools in place?

A: They often succeed before tooling has a chance to intervene. Modern phishing uses urgency, familiar brands, and multiple channels to push a user into entering credentials or payment data, which means the control failure is frequently human decision speed rather than missing detection logic.

Q: What should teams do when an exposed web application has likely been compromised?

A: Assume the host may have exposed secrets, tokens, and metadata, then contain the identity blast radius by revoking affected credentials, hunting for persistence, and reviewing outbound connections. Exposure that reaches the application layer can quickly become account-level compromise.

Q: What is the difference between malware delivery and identity compromise?

A: Malware delivery is the path into the environment, while identity compromise is the point where stolen credentials, session artefacts, or privileged access become usable. A team can remove the malware and still remain exposed if the attacker kept a valid session or harvested secrets before detection.

Technical breakdown

Why infostealers remain effective against identity controls

Infostealers such as SantaStealer and Phantom Stealer do not need to break encryption or exploit deep kernel weaknesses to be useful. They target browser-stored passwords, session cookies, wallet data, and application credentials, then exfiltrate the results through command-and-control infrastructure. The important mechanism is not the malware family name but the theft of identity artefacts that already exist in user environments. Once a cookie or password store is harvested, an attacker often inherits the same trust the legitimate user had, which makes the access look normal unless telemetry is strong.

Practical implication: monitor browser credential stores, session reuse, and post-login anomalies as first-class identity signals.

How phishing campaigns now operate as credential collection pipelines

The holiday phishing activity described in the article shows how modern lures are built to collect data at scale across email, SMS, WhatsApp, fake retail sites, and even chatbot-driven storefronts. The technical shift is toward rapid message generation, infrastructure reuse, and workflow abuse, where a victim is guided from trust cue to credential entry with very little friction. The result is not just more phishing volume but more varied collection points, each designed to capture identity data before the user or a control layer realises the interaction is malicious.

Practical implication: treat phish-resistant authentication and verified communication channels as part of identity protection, not just user awareness.

What exploit chaining changes for exposed application identity

React2Shell exploitation shows how an application flaw can become an identity problem once attackers deploy backdoors, proxy tooling, or credential access tooling after initial compromise. The first stage is exposure of an internet-facing service, but the operational value comes from what happens next: persistent access, discovery, and use of the compromised host as a foothold into adjacent systems. When exploit kits become automated and payload-agnostic, the boundary between vulnerability management and identity security narrows because access artefacts, metadata, and secrets on the host become part of the attack surface.

Practical implication: correlate patch exposure with secret discovery, host persistence, and unusual outbound connections, not just with the vulnerable CVE.

Threat narrative

Attacker objective: The attacker’s objective is to convert short-lived access opportunities into durable identity-controlled access that can be monetised through theft, extortion, or further intrusion.

1. Entry occurs through phishing, malicious attachments, password spraying, or exploitation of exposed React and Next.js services.
2. Escalation follows when attackers harvest browser credentials, session cookies, API keys, or deploy backdoors and proxy tools for persistent access.
3. Impact is achieved by using stolen identity artefacts to move into accounts, exfiltrate data, or maintain quiet follow-on access.

Breaches seen in the wild

• MongoBleed breach — MongoBleed exposed secrets across 87K MongoDB servers.
• IOS app secrets leakage report — iOS apps leaking hardcoded secrets and credentials endangering user privacy.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity theft is now the common denominator across malware, phishing, and exploit activity. The article’s examples are different delivery paths, but the security outcome is the same: attackers want working credentials, cookies, or authenticated sessions. That means identity teams should read these stories as one control problem, not several disconnected threats. The practitioner conclusion is that identity artefact protection must be treated as a core defensive layer.

Session cookies are operational credentials, not temporary browser clutter. Infostealers increasingly target session artefacts because they bypass password reset friction and can survive MFA if the session is still valid. That makes browser session theft a governance problem as much as a malware problem. The practitioner conclusion is that session-aware detection and revocation need the same seriousness as password compromise.

ClickFix-style lures and AI-generated scams raise the value of human-paced security decisions. The campaign volume described in the article shows that attackers can industrialise trust abuse faster than many teams can manually review messages or verify transactions. Identity programmes that rely too heavily on after-the-fact detection will always be behind. The practitioner conclusion is to reduce the number of human decisions that can directly grant or extend access.

Ephemeral credential trust debt: modern identity programmes often assume that short-lived credentials are inherently safer, but stolen sessions, browser tokens, and rapidly reused secrets show that short duration does not eliminate reuse value. That assumption fails when attackers can harvest and act on identity artefacts faster than the normal governance cycle can see them. The practitioner conclusion is that expiry alone is not a control boundary.

Exploit exploitation and identity abuse now intersect at the host layer. React2Shell-style incidents show that once a public-facing service is compromised, the next question is often which secrets, metadata, and tokens are reachable from that host. This blurs traditional lines between appsec, cloud security, and IAM. The practitioner conclusion is that host-level compromise should trigger identity containment workflows immediately.

From our research:

• The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
• Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap.
• For a broader view of breach patterns, see The 52 NHI breaches Report for recurring access and secret exposure themes.

What this signals

Identity teams should expect more malware families to act as credential harvesting front ends rather than standalone payloads. The operational change is that endpoint compromise is increasingly just a means to reach sessions, browser stores, and service credentials. Programmes that do not unify endpoint, identity, and secret telemetry will keep missing the real attack boundary.

With 43% of security professionals already concerned about AI systems learning and reproducing sensitive information patterns from codebases, the pressure on secret hygiene is no longer limited to human error. That concern should push teams to tighten developer workflows, secret discovery, and token revocation across both code and runtime.

The next maturity step is not another isolated control but faster identity containment when exposure is detected. Teams that can revoke sessions, rotate secrets, and correlate suspicious authentication activity quickly will reduce the attacker’s usable window far more effectively than teams focused only on malware naming.

For practitioners

• Harden browser and session artefact exposure Restrict where passwords, cookies, and session tokens are stored, and review endpoint controls that allow infostealers to harvest browser data without resistance.
• Prioritise phish-resistant login paths Use MFA methods that resist replay and automate checks for anomalous login attempts, especially on remote access portals and high-value accounts.
• Treat ISO files and mounted media as executable risk Alert on mounted disk images, archive execution, and unusual child processes so finance and accounting users are not the only line of defence.
• Trigger identity containment after public service compromise When an internet-facing application is exploited, assume local secrets, tokens, and metadata may have been reached and revoke or rotate them immediately.

Key takeaways

• The article shows that identity artefacts such as passwords, cookies, and tokens are now a primary target across multiple attack types.
• The evidence points to scalable abuse, from mass phishing and password spraying to exploit-driven persistence and infostealer exfiltration.
• Practitioners should tighten session controls, reduce credential exposure, and make identity containment automatic when compromise is suspected.

Key terms

• Infostealer: An infostealer is malware built to collect credentials, session material, tokens, and other authentication data from infected systems. In NHI programmes, the risk is not only theft but reuse, because harvested workload secrets can unlock cloud access long after the initial infection.
• Persistent Cookie: A persistent cookie is a session cookie that remains valid after the browser closes until it expires or is explicitly removed. In remote access designs, it can improve usability, but it also increases the chance that a reused session becomes standing access if the organisation does not enforce compensating controls.
• Password Spraying: A guessing technique that uses a small set of common passwords against many accounts to avoid lockouts and detection. It is effective when organisations do not reject common passwords, do not monitor patterns across identities, or allow too much standing access.
• Identity Containment: The practice of revoking or constraining an identity’s ability to act after compromise is suspected. It goes beyond isolating the device and includes session termination, token revocation, privilege reduction, and validation of what the identity can still reach.

What's in the full analysis

Anomali's full article covers the operational detail this post intentionally leaves for the source:

• MITRE ATT&CK mappings for each campaign and exploit pattern.
• The specific malware behaviours and payload delivery paths tied to each threat item.
• The exact telemetry and detection cues referenced in the analyst commentary.
• The broader weekly Cyber Watch context around how these incidents fit together.

👉 Anomali's full Cyber Watch post includes the MITRE ATT&CK details and campaign-level context behind each threat item.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.