Topic starter
25/10/2026 11:09 am
TL;DR: Infostealers are now a primary identity-exposure mechanism, with 7.4M infected hosts and devices and 1.7B stolen credentials in H1 2026, according to Flashpoint. Identity risk now depends on how quickly teams revoke exposed credentials and live sessions after discovery.
Editorial analysis by NHI Mgmt Group, based on content published by Flashpoint: “Global Threat Intelligence Report: 2026 Midyear Edition”.
By the numbers:
- Flashpoint recorded 7.4M infected hosts and devices globally in the first half of 2026.
- Flashpoint reports a 27% period-over-period increase in information-stealing malware operations.
- Flashpoint says over 22M AI-related illicit discussions appeared in underground forums.
Key questions
Q: Why do infostealers make session revocation more important than password resets?
A: Because attackers often use session cookies and tokens that remain valid even after a password change.
Q: What signs suggest stolen credentials are being operationalised, not just collected?
A: Look for suspicious login attempts from unusual geographies, repeated authentication against cloud and SaaS services, and evidence that exposed sessions are being tested at scale.
Q: What breaks when attackers can reuse stolen cloud credentials in SaaS environments?
A: When stolen credentials work in SaaS, the organisation loses the assumption that authentication proves legitimacy.
Practitioner guidance
- Implement continuous token revocation policies Revoke active endpoint tokens and cloud sessions automatically when exposed credentials or session artefacts are identified in underground logs.
- Harden browser and endpoint credential storage Disable credential caching in enterprise browsers and review local storage of authentication artefacts on managed endpoints.
- Adopt phishing-resistant authentication Prioritise hardware-backed authentication methods for high-value accounts and remove reliance on reusable passwords where possible.
Bottom line: Infostealers are now a primary identity-exposure mechanism because they collect reusable credentials and live sessions at scale.
Glossary terms: Infostealer, Session Token Exposure, Underground Access Economy, Continuous Access Evaluation
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
27/10/2026 7:17 pm
Infostealer logs have become an identity supply chain, not just a malware by-product. Flashpoint’s reporting shows a system where infected hosts, harvested credentials, underground marketplaces and automated testing are linked into one operational pipeline. That changes the governance problem from endpoint compromise to identity reuse across environments. Practitioners should treat exposure monitoring as part of access governance, not only threat intelligence.
A question worth separating out:
Q: How should security teams respond when a live session token appears in an underground log dump?
A: Treat it as an active identity compromise, not a future risk. Revoke the token, terminate related sessions, force credential reset where required, and review downstream access paths that may have been opened through the session. The response should be immediate because the token may already be in use.
👉 Read our full editorial: Infostealers now drive identity-first intrusion at industrial scale
This post was modified 7 days ago by NHI Mgmt Group