Stealerium-based infostealers expose the growing NHI attack surface

At a glance

What this is: Proofpoint says Stealerium-based campaigns are increasing, and the malware is being used to harvest browser cookies, credentials, tokens, Wi-Fi data and other sensitive information at scale.

Why it matters: This matters because stolen NHI secrets often become the first step in later access abuse, so identity teams need visibility into how infostealers convert endpoints into credential-extraction points.

Context

Stealerium-based malware is an infostealer pattern, not a single campaign. It matters to identity security because the payload is designed to collect credentials, session tokens, browser data and other artefacts that can be reused as non-human identities or access material.

Proofpoint observed multiple 2025 campaigns using compressed executables, JavaScript, VBScript, ISO, IMG and ACE attachments, with lures tied to invoices, travel, legal notices and other urgent themes. The governance problem is that this is no longer a niche threat path; it is a repeatable delivery model for identity theft and downstream access abuse.

Key questions

Q: What should teams do immediately after an infostealer is detected on a user device?

A: Isolate the endpoint, reset any exposed credentials, revoke active sessions, and invalidate VPN or browser-backed tokens that may have been captured. Then review adjacent accounts and shared access paths, because commodity stealers often turn one infected host into a wider identity incident.

Q: Why do infostealers create such high identity risk?

A: They harvest reusable access material instead of forcing a new login. Cookies, saved passwords, tokens, and secrets often outlive the malware event itself, so the attacker can reuse them from elsewhere. This is why identity teams need to treat endpoint compromise as a direct threat to session and secret integrity.

Q: What are the signs that a Stealerium-like campaign is active in an environment?

A: Watch for archive-heavy email lures, script execution from attachments, netsh wlan commands, scheduled task creation, Defender exclusions and headless browser activity. Those signals together point to post-execution theft, recon and exfiltration rather than ordinary user behaviour.

Q: How should security teams respond to stolen browser tokens and cookies?

A: Treat them as compromised credentials, not as disposable browsing data. Revoke sessions, reset affected accounts, check for reuse across systems and review whether the token was bound tightly enough to limit replay from a different device or network.

Technical breakdown

How Stealerium-based malware gets initial execution

Stealerium campaigns rely on social engineering to get the payload started, usually through compressed executables or script-based attachments. Once opened, the malware can stage a download, execute its loader and blend into normal user activity long enough to begin data collection. The article shows a broad delivery mix, which matters because defenders cannot rely on a single file type or lure theme. The technical issue is not sophistication in exploitation, but consistency in user-triggered execution followed by rapid theft of identity artefacts.

Practical implication: block risky attachment types, detonate script-based files, and tighten email controls around archive and image formats.

Why browser credentials and tokens are the real prize

Stealerium is built to extract browser cookies, stored credentials, session tokens and related data that can be reused outside the endpoint. In practice, that means the malware is not just stealing passwords. It is collecting authenticated session material that may bypass MFA or other interactive controls if the token is still valid. The article also notes browser remote debugging abuse, which is a common way stealers get around browser protections and reach sensitive state stored in the session layer.

Practical implication: treat browser session material as a governed credential class, not just user data.

How post-infection recon and exfiltration work

After execution, the malware enumerates Wi-Fi profiles, nearby networks and other system details, then stages collected data for exfiltration through channels such as SMTP, Discord, Telegram, Gofile and Zulip. That combination matters because it links local theft to lateral movement preparation and flexible exfiltration paths. The Wi-Fi activity suggests reconnaissance for nearby access opportunities, while the multiple exfiltration options make simple sinkhole blocking insufficient on its own. This is a classic example of commodity malware turning endpoint visibility into identity and access leverage.

Practical implication: monitor for post-execution recon commands and restrict outbound access to consumer messaging and file-transfer services.

Threat narrative

Attacker objective: The attacker wants reusable identity material, access artefacts and exfiltrated data that can support follow-on fraud, lateral movement or account takeover.

1. Entry occurs through business-themed lures that deliver compressed executables, scripts or disk images and persuade a user to open the payload.
2. Credential and data collection follow execution, as the malware steals browser cookies, stored credentials, session tokens, Wi-Fi data and other sensitive artefacts.
3. Escalation comes from reusing harvested session material and reconnaissance data to support broader access abuse or nearby network staging.
4. Impact is credential reuse, data exfiltration and the creation of reusable NHI exposure that can feed later intrusion activity.

Breaches seen in the wild

• Shai Hulud npm malware campaign: Shai Hulud campaign: npm malware exposed secrets on GitHub.
• Schneider Electric Jira breach 2024: Credentials linked to a Lumma infostealer infection gave Hellcat access to Schneider Electric's Jira; 40GB and 400,000 user rows claimed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Stealerium turns identity theft into a commodity delivery pattern: The important shift is not that stealers can collect credentials, but that open-source malware now makes that behaviour repeatable for low-skill actors. Once tokens, cookies and stored passwords become standard theft targets, NHI exposure stops being an edge case and becomes an expected outcome of ordinary phishing-style delivery. The practitioner conclusion is that identity governance has to assume hostile reuse of session artefacts, not just password compromise.

Session tokens are now part of the credential estate: This article shows why browser cookies and tokens cannot be treated as ephemeral convenience data. If a stealer can extract authenticated session state, the organisation loses control over who can replay access, even when passwords remain unchanged. The practitioner conclusion is that the identity surface includes the browser session layer, not only directory credentials.

Stealerium is a reminder that overreliance on endpoint trust creates identity risk: The malware's Wi-Fi recon, browser abuse and multi-channel exfiltration show how much value attackers gain once a single workstation is compromised. That is why NHI governance must connect endpoint telemetry to account risk and access revocation, especially when reused credentials can outlive the original host event. The practitioner conclusion is that containment has to reach beyond the endpoint into the identity layer.

Open-source malware lowers the barrier to credential abuse: Proofpoint's analysis shows code overlap across Stealerium, Phantom Stealer and related variants, which means defenders face a family of reused techniques rather than one named sample. That widens the detection problem and makes static signatures less durable. The practitioner conclusion is to focus on behaviours and credential hygiene, not malware naming alone.

Stealerium creates identity blast radius from a single click: A business lure, one execution and a session replay opportunity can turn a user endpoint into a multi-account compromise path. That is a governance failure, not just an endpoint event, because the stolen artefacts often sit outside traditional password reset workflows. The practitioner conclusion is to treat stealer containment as identity containment.

From our research library:

• 54% of ransomware victims had credentials exposed before the attack, according to Verizon's 2025 Data Breach Investigations Report.

What this signals

Credential replay is the core governance problem: Stealerium-based campaigns matter because browser cookies, session tokens and saved passwords are all usable identity material once they leave the endpoint. Identity programmes that still separate endpoint response from credential response will miss the real containment window.

Identity blast radius is now measured in browser state: A stealer does not need to break a directory to create account risk. If it can harvest session artefacts from one user workstation, the resulting compromise path may spread across email, VPN, chat and cloud services.

Browser session governance needs to become explicit: Teams should decide which tokens, cookies and cached credentials are revocable, monitorable and tied to device trust, because that is where commodity infostealers are extracting value.

For practitioners

• Harden attachment and script handling Quarantine compressed executables, ISO and IMG attachments by default, and detonate JavaScript and VBScript payloads before delivery to the user.
• Treat session tokens as governed credentials Inventory browser session artefacts, token stores and saved credentials as part of the credential estate so theft of cookies or tokens triggers identity response, not just endpoint cleanup.
• Watch for stealer post-execution behaviour Alert on netsh wlan activity, unusual PowerShell exclusions, scheduled task creation and headless browser execution because these are common signs of Stealerium-style post-infection activity.
• Restrict common exfiltration paths Limit or inspect outbound traffic to Discord, Telegram, Gofile, Zulip and similar services where malware can stage stolen data for removal from the environment.
• Revoke access after credential theft events When endpoint telemetry or threat intel shows stealer infection, force password resets, session revocation and token invalidation across the affected identity set, not just the device.

Key takeaways

• Stealerium-based campaigns show how commodity malware now turns browser state and saved credentials into reusable identity risk.
• The article describes broad lure diversity, archive and script delivery, and theft of cookies, tokens, Wi-Fi data and other sensitive material.
• The limiting control is not just endpoint cleanup. Identity teams need session revocation, token invalidation and tighter governance of browser-held credentials.

Key terms

• Infostealer: An infostealer is malware built to collect credentials, session material, tokens, and other authentication data from infected systems. In NHI programmes, the risk is not only theft but reuse, because harvested workload secrets can unlock cloud access long after the initial infection.
• Session Token Exposure: Session token exposure occurs when authentication tokens or session artifacts are stored, transmitted, or logged in places they should not be. Once exposed, they can function like reusable credentials. This makes them part of identity and access risk, not only application behaviour.
• Browser Remote Debugging: Browser remote debugging is a developer feature that exposes internal browser state for inspection and automation. Attackers abuse it to access cookies, credentials and session data that are otherwise protected by normal browser boundaries.
• Credential replay: Credential replay is the reuse of stolen authentication material to impersonate a legitimate user or system. In human identity programmes, replay risk grows when passwords, OTPs, or weak recovery flows can be captured and used from a separate device or session.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.