Phishing, infostealers, and exploit chains are converging on identity

At a glance

What this is: Anomali’s Cyber Watch shows phishing, infostealers, password spraying, and exploit-driven access are merging into one identity-focused attack pattern.

Why it matters: IAM, NHI, and SOC teams need to treat credential theft, session capture, and exposure windows as one governance problem, not separate threat classes.

Context

The security gap is no longer a single weak control but the overlap between identity abuse, user execution, and exposed services. When phishing lures, infostealers, and exploit chains all end in stolen credentials or session data, programme boundaries that separate email security, endpoint protection, and IAM become less useful.

In this article, identity is the common target even when the initial access path differs. Some campaigns rely on user action, others on vulnerable internet-facing applications, but the operational outcome is similar: attackers want authenticated access, browser-stored secrets, or a foothold that lets them move quickly into the victim environment.

That convergence is typical of the current threat landscape rather than an edge case. Security teams should read it as a sign that credential protection, exposure reduction, and post-compromise monitoring now need to be designed as one response path.

Key questions

Q: What breaks when phishing, infostealers, and exploit chains all target identity at once?

A: The usual separation between email security, endpoint response, and IAM breaks down because attackers do not care which control failed first. They want whichever credential, cookie, or foothold gets them authenticated access fastest. Security teams need to investigate identity impact across the chain, not just the initial lure or payload.

Q: Why do stolen browser cookies create such a high risk for account takeover?

A: Browser cookies can act as bearer credentials, so whoever possesses them may be able to replay a session without knowing the password. That makes stolen cookies especially dangerous when attackers can validate the session in a normal browser and move directly into the account. The risk rises further when the targeted account has monetization, reputation, or administrative reach tied to it.

Q: How should security teams detect password spray attacks without overwhelming analysts with false positives?

A: Security teams should combine authentication event analysis with baseline-aware detection that looks for repeated, distributed login failures across multiple accounts and systems. Good detection should correlate timing, source behavior, and account targeting patterns, then elevate only activity that matches known attack logic. The goal is to separate signal from noise so analysts can act on credible threat patterns quickly.

Q: What should teams do after an exposed service is exploited?

A: Assume the first payload is only the beginning and hunt for persistence, proxy tooling, unexpected outbound traffic, and access to adjacent identity stores. The response goal is to identify what the attacker can still reach, because automated exploitation often leaves a quiet follow-on access path even after the initial compromise is obvious.

Technical breakdown

Why phishing and infostealers now feed the same identity risk

Modern phishing and infostealer campaigns increasingly pursue the same prize: credentials, cookies, and other session artefacts that bypass password resets alone. A stealer running in memory can avoid simple file-based detection while collecting browser-stored passwords, session cookies, and app credentials, then exfiltrating them in chunks to attacker infrastructure. That makes the boundary between initial access and identity compromise much thinner than many programmes assume. Once session material is stolen, the attacker can often operate as the user without needing a fresh login event, which complicates detection and response.

Practical implication: Treat browser sessions, stored secrets, and credential stores as a single attack surface, not separate tools and teams.

How exploit chains turn exposed services into identity compromise

Exploit-driven campaigns change the sequence, but not the end goal. When attackers rapidly scan for exposed services, deliver payloads within minutes, and then add backdoors or proxy tooling, the compromise often becomes a quiet identity problem rather than a loud malware event. Exploitation creates the initial foothold, but the real value comes from persistence, proxying, and follow-on access that can impersonate legitimate traffic. For defenders, the presence of one payload is less important than whether the system can still be used to reach identity stores, cloud metadata, or internal services after the first compromise.

Practical implication: Hunt for follow-on access paths after exploitation, not just the initial payload or binary.

What password spraying shows about weak identity boundaries

Password spraying remains effective because it exploits organisations that still treat authentication noise as normal internet background. The attack does not need a software flaw if exposed login portals accept repeated guesses and lack strong multi-factor enforcement or rate controls. At scale, this becomes a measurement problem as much as a prevention problem: repeated failures across multiple vendors can signal coordinated pressure before an account is taken over. In practice, this is a reminder that authentication controls fail when they are applied inconsistently across remote access surfaces.

Practical implication: Use repeated login attempts across remote access systems as an early warning signal and tighten enforcement at the authentication layer.

Threat narrative

Attacker objective: Obtain usable identity material or persistent access that enables theft, covert control, or downstream monetisation.

1. Entry begins through phishing, malicious attachments, or exploitation of exposed public services, depending on the campaign described.
2. Credential harvesting follows through browser stores, session cookies, clipboard data, or automated password spraying against remote access portals.
3. Escalation occurs when stolen credentials or footholds are used to reach additional systems, maintain access, or deploy proxy and backdoor tooling.
4. Impact is achieved through data theft, persistent access, or operational disruption that outlives the original lure or exploit.

Breaches seen in the wild

• Schneider Electric Jira breach 2024: Credentials linked to a Lumma infostealer infection gave Hellcat access to Schneider Electric's Jira; 40GB and 400,000 user rows claimed.
• EmeraldWhale Git config credential theft: Tokens in exposed .git/config files let EMERALDWHALE clone private repositories and steal more than 15,000 cloud credentials.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity compromise is now the common endpoint across different intrusion paths. Phishing, stealer malware, password spraying, and exploit chains look different at the front door, but they converge on the same prize: authentication material and session control. That convergence means IAM, endpoint, and exposure management can no longer be run as disconnected programmes. The practitioner conclusion is that identity telemetry has become the shared control plane for multiple threat classes.

Session data has become a first-class identity asset. When attackers steal browser cookies, tokens, and stored credentials, they often bypass the controls that were built around password resets and account lockout. This is a control gap, not just a malware issue. The implication is that organisations need to treat session artefacts as governed access material, with the same operational seriousness as passwords and API secrets.

Exploit chains increasingly behave like identity supply chains. An exposed application, a proxy foothold, or a malicious attachment can all become upstream sources of trust that feed later credential abuse. That makes the attack path more important than the malware family name. Practitioners should reframe exposure reduction and identity monitoring as one continuous risk domain.

Identity blast radius is the right named concept for this pattern. Once a single stolen login, cookie, or foothold can unlock multiple systems, the question is no longer whether an account was compromised, but how far that compromise can travel. This is where governance has to focus on containment boundaries, not just prevention checkpoints. The practitioner conclusion is to measure how much access one identity artefact can realistically unlock.

MITRE ATT&CK remains useful here, but only when it is tied to the identity outcome. Tactics such as credential access, user execution, and lateral movement describe the path, yet the operational objective is still identity abuse. That framing helps teams avoid over-indexing on payload type and under-indexing on the access it creates. The practitioner conclusion is to build detections around identity impact, not malware labels.

From our research library:

• The IBM/Ponemon 2025 Cost of a Data Breach Report found that phishing-initiated breaches cost an average of $4.8M each.

What this signals

Identity blast radius: The practical question is no longer whether a campaign uses phishing, stealer malware, or exploit code, but how far one stolen artefact can travel once it lands. That pushes security leaders toward tighter session governance, faster exposure reduction, and better correlation across identity and endpoint telemetry.

When exploit activity becomes automated, the attacker’s advantage shifts from novelty to speed. That means teams need to watch for the transition from first compromise to follow-on access, because the window for intervention is often much shorter than the time it takes to complete a traditional incident review.

For practitioners

• Correlate phishing, stealer, and VPN telemetry Join email, endpoint, and remote access logs so repeated lures, credential theft signals, and password-spraying attempts can be analysed as one intrusion pattern.
• Inspect browser-stored secrets and session artefacts Prioritise inventory and response for passwords, cookies, and tokens held in browsers because those artefacts often outlive the initial compromise and enable silent reuse.
• Harden exposure around public-facing services Reduce the time vulnerable services remain internet reachable, and treat exposed React or Next.js instances as priority hunting targets when exploitation is active.
• Raise the bar on remote access authentication Enforce multi-factor authentication, rate limiting, and alerting on repeated failed logins across VPN and other remote access portals before password spraying matures into account takeover.

Key takeaways

• The article shows a single intrusion pattern emerging across phishing, infostealers, password spraying, and exploit chains, with identity material as the common target.
• The operational risk is not limited to malware infection. Stolen credentials, cookies, and exposed services can each deliver authenticated access that outlives the initial attack vector.
• Security teams should respond by correlating identity, endpoint, and exposure telemetry so they can spot the whole chain instead of treating each campaign as a separate event.

Key terms

• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Session artefacts: Temporary access material such as active login sessions, cookies, tokens, and cached credentials that prove trust without requiring the original password again. These artefacts are often the shortest path from endpoint compromise to cloud or SaaS account abuse.
• Password Spraying: A guessing technique that uses a small set of common passwords against many accounts to avoid lockouts and detection. It is effective when organisations do not reject common passwords, do not monitor patterns across identities, or allow too much standing access.
• Exploit Chain: A sequence of vulnerabilities or malicious steps that work together to move from initial exposure to full compromise. In practice, one weakness may not be enough on its own, but chained weaknesses let attackers bypass normal protections and reach code execution, data theft, or device control.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.