TL;DR: Browser-stored session URLs often travel with passwords, turning a stolen profile into a labeled route to a specific machine, account and port rather than a reusable secret alone, according to Flare’s analysis of 15,101 credential entries across four industrial remote access platforms. Identity governance breaks when the address itself becomes the access artifact.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Flare's report: Industrial remote access URLs can expose machine, account and port details, and stolen browser profiles can carry the whole route.
Why it matters: This matters because remote access links can become discoverable credentials in their own right, expanding the blast radius of infostealer infections and weakening contractor access governance.
By the numbers:
- 374 of 511 tunnel addresses appeared in the same stolen record as a device credential.
- Of 2,032 usernames stored against those addresses, 1,952 were administrative.
- The median interval between first and last observation was 51 days for addresses seen more than once.
Context
Industrial remote access often uses browser-based tunnels that expose the live session through the URL itself. That design makes the session easier to reach from a browser, but it also means the browser can store more than a password: it can retain the route to a specific machine, site, account and forwarded service.
When credential-stealing malware copies a browser profile, it can collect those stored routes along with the login data. In practice, that turns remote access from a secret protected by authentication into a discoverable access path that sits inside ordinary browser state, and that is a governance problem for third-party access as well as for secrets management. Treat third-party access governance as part of the answer, not an adjacent concern.
Key questions
Q: How do stolen browser profiles expose industrial remote access sessions?
A: Stolen browser profiles can expose saved login state, session cookies, autofill data and bookmarked remote access portals, letting an attacker resume an industrial session without the password. Protect profiles with device encryption, phishing-resistant MFA, short session lifetimes and reauthentication for privileged actions. browser profiles can store more than just bookmarks, so profile theft often becomes session theft.
Q: Why do descriptive tunnel URLs increase remote access risk?
A: Descriptive tunnel URLs make remote access easier to discover, recognise and reuse by anyone who sees logs, emails or browser history. A predictable URL can also reveal the asset, site or function behind the tunnel, which helps attackers target valid entry points. Use randomised URLs, per-user authentication and time-bound access tokens to reduce exposure.
Q: How should teams govern third-party industrial access routes?
A: Third-party industrial access routes should be governed as supplier accounts with named ownership, least-privilege entitlements, MFA, approval workflows, logging and periodic recertification. supplier identity lifecycle management should cover onboarding, scope changes, credential rotation, suspension and offboarding, so a contractor or integrator cannot retain stale remote routes after the work ends.
Q: What is the difference between a password and a session URL in remote access?
A: A password proves a user knows a secret, while a session URL can point directly to an active or pre-authenticated remote access session. If the URL is copied, logged or forwarded, it may function like a bearer link and bypass normal login checks until it expires or is invalidated. Use short-lived sessions, token binding and strict revocation controls.
Technical breakdown
Why browser-stored session URLs become access artifacts
Industrial remote access platforms commonly externalise the live session into a browser-friendly URL so the engineer can resume the right tunnel quickly. The problem is that browsers treat URLs as ordinary navigation state, so saved credentials, history and session restore can preserve the address that identifies the target machine, not just the secret that opened it. Once credential-stealing malware harvests a browser profile, the URL field becomes part of the stolen identity material. That changes the unit of exposure from a password that might work somewhere to a labeled route that points to a specific operational asset. Read the Ultimate Guide to NHIs: Static vs Dynamic Secrets.
Practical implication: Review whether your remote access design stores session identity in browser-recoverable state and treat that as recoverable access, not just convenience.
Why path structure can disclose customer, machine and protocol details
Some remote access platforms encode customer account names, machine labels, forwarded protocol values and ports directly in the path. That is not a defect by itself, but it is a disclosure model with consequences once the URL is copied, cached or stolen. A path that describes the target makes the session self-documenting for the legitimate operator and self-identifying for an attacker holding the browser record. In environments where contractors and integrators maintain many customer sites, the exposed path can reveal operational relationships, internal naming conventions and the exact services reachable through the tunnel.
Practical implication: Treat URL path elements as sensitive identity metadata and remove unnecessary descriptive fields from any access route that can be persisted or exported.
Why administrative accounts amplify the impact of exposed routes
The risk is not just that a route is visible. It is that the route is often paired with administrative credentials for the device or portal behind it. When the same stolen record contains both the path and the login, the attacker no longer needs to infer which machine to try or which credential belongs to it. The corpus in this analysis shows that administrative accounts dominate these records, which is exactly the kind of privilege concentration that turns a single exposed tunnel into a higher-value compromise path. For industrial operators, privilege scope and route disclosure need to be governed together.
Practical implication: Separate access path exposure from privilege assignment so a stolen session record does not also carry elevated reach.
Threat narrative
Attacker objective: The attacker wants a ready-made route into an industrial environment, paired with the login data needed to reach the target machine or service.
- Entry begins when infostealer malware harvests a browser profile from an engineer’s workstation and copies the saved remote access URL with it.
- Credential access occurs because the same stolen record often contains the password or device login used for the industrial portal behind that URL.
- Escalation follows when the attacker can use the labeled route together with administrative credentials to reach a specific machine, site or forwarded service.
- Impact is the ability to access industrial remote sessions with far less discovery work, increasing the chance of misuse against operational technology and managed plant systems.
Breaches seen in the wild
- Dropbox Sign breach 2024: A compromised back-end service account gave attackers Dropbox Sign customer data, including API keys, OAuth tokens and MFA information.
- Toyota T-Connect key exposure 2022: A subcontractor left a T-Connect server key on public GitHub from 2017 to 2022; 296,019 customers' emails were exposed, misuse unknown.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Remote access URLs have become identity-bearing artifacts, not just navigation data. In this class of platform, the browser record can preserve the session route, the customer context and the forwarded service details alongside the credential itself. That means a stolen profile can carry enough context to collapse the attacker’s discovery work before any login attempt begins. The practitioner implication is that browser-stored access metadata now belongs in identity governance, not only in endpoint hygiene.
Standing privilege and descriptive routing are a dangerous combination in industrial access. The strongest risk signal in this corpus is not merely that credentials were stolen, but that the route and the credential were often stolen together. That is a specific governance failure mode: access was encoded in a form that survives browser theft and was frequently paired with administrative reach. The implication is that industrial remote access should be reviewed as a combined path-and-privilege problem, not as separate login and network questions.
Access review cadences do not address session-recoverable routes. This corpus shows that some routes persist in stolen records for weeks, months or longer, which means the exposure window can outlast the operational assumption that access will be discovered and reviewed before misuse. The implication is not just stale credentials, but stale routes that remain intelligible long after issuance. Governance has to account for how long a browser-visible access path remains recoverable after the original session ends.
Third-party access is the dominant governance boundary here, not the plant perimeter. The patterns in the data point to contractors, integrators and managed service operators who legitimately need broad reach across many customer environments. That makes lifecycle control, naming discipline and route design part of supplier governance rather than a narrow OT concern. The practitioner implication is to govern remote access as delegated identity across the supply chain, with the same rigor used for privileged third-party accounts.
Ephemeral access only helps if the route itself is ephemeral. Short-lived credentials do not fully solve this exposure pattern when the browser persists a stable, descriptive tunnel address. The named concept here is route persistence leakage: a session model that leaves behind enough URL structure for stolen browser state to become usable access context. Practitioners should treat the recoverability of the route as part of the identity design, not as an incidental detail.
What this signals
Route recoverability is now part of industrial access design. If a browser can restore the tunnel address, the access boundary persists beyond the intended session. That pushes practitioners toward designs where route, credential and privilege all expire together rather than on separate cadences.
Industrial remote access programmes need to stop treating browser state as harmless convenience. When portal URLs carry machine identity, session state becomes a governance object, and stolen endpoints can reveal more than passwords.
The next control question is whether remote access can be made meaningful without leaving a reusable route behind. If the answer is no, then identity and session design are already coupled, even if the programme has been managing them separately.
For practitioners
- Harden browser recovery paths for remote access sessions Disable unnecessary session restore, history retention and profile sync on engineering endpoints that use browser-based industrial access portals.
- Minimise identity details in tunnel URLs Remove customer names, machine labels, forwarded protocol values and internal addresses from any access path that can be stored or copied.
- Separate administrative reach from discoverable routes Ensure elevated device credentials are not recoverable from the same browser state that stores the tunnel URL and portal session.
- Govern contractor access as delegated identity Review third-party remote access as a supplier lifecycle problem, including sponsorship, time limits, revocation and portfolio-wide entitlement review.
- Monitor stealer-log exposure for access routes Watch for industrial session addresses, router management links and vendor portal entries in stolen credential corpora so you can revoke them before they are reused.
Key takeaways
- Industrial remote access can leak more than passwords because the browser may preserve a usable route to the target machine.
- In the measured corpus, tunnel addresses and administrative credentials often appeared together, which raises the value of every stolen browser profile.
- The practical control problem is to govern route exposure, session persistence and delegated access as one lifecycle, not as separate issues.
Related NHI Mgmt Group resources: Secrets Management Guide · Third-Party, B2B and Contractor Access Guide · Guide to the Secret Sprawl Challenge · Ultimate Guide to NHIs: Static vs Dynamic Secrets
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | Stolen browser profiles expose session URLs and credentials together, which is a secret leakage problem. |
| NHI-05 — Overprivileged NHI | Administrative account names dominate the exposed records, showing excessive privilege tied to reachable routes. | |
| NHI-07 — Long-Lived Secrets | Some session addresses persist in stolen records for months or longer, which extends the exposure window. | |
| Recommendation — Scan for exposed session URLs and revoke any NHI credentials that travel with browser-stored access state. Reduce administrative scope on remote access identities so a leaked route does not open elevated plant access. Shorten the usable lifetime of remote access artefacts and rotate anything that remains recoverable in browser state. | ||
| MITRE ATT&CK | TA0006; TA0008 — Credential Access; Lateral Movement | Infostealer collection of browser state enables credential access and easier movement into industrial sessions. |
| Recommendation — Map stolen browser profiles to TA0006 and TA0008 to prioritise exposed remote access paths for containment. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The issue is a mismatch between what the route reveals and what the associated identity is allowed to reach. |
| Recommendation — Apply PR.AA-05 to align remote access entitlements with the smallest reachable industrial scope. | ||
Key terms
- Industrial Secure Remote Access: Industrial Secure Remote Access is controlled remote connectivity to operational technology environments, such as factories, utilities, and critical infrastructure. It allows approved users, vendors, or systems to reach industrial assets without exposing them broadly. Technically, it combines strong authentication, least privilege, session control, monitoring, and segmentation to reduce operational and cyber risk.
- Session URL: A session URL is a web address that opens a specific login session, resource or access route. In remote access systems it may carry a session identifier or token in the path or query string, so possession of the link can grant access until the session expires or is revoked.
- Browser Profile Theft: Browser profile theft is the unauthorised copying of a user’s browser data, including cookies, saved passwords, autofill entries and synced history. Attackers use it to hijack authenticated sessions, reuse credentials and access internal portals without re-entering the password.
- Infostealer: An infostealer is malware built to collect credentials, session material, tokens, and other authentication data from infected systems. In NHI programmes, the risk is not only theft but reuse, because harvested workload secrets can unlock cloud access long after the initial infection.
Deepen your knowledge
NHI governance, machine identity security, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or NHI governance programme, it is worth exploring.
Published by the NHIMG editorial team on November 9, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org