Infostealer activity in 2026: what IAM and SOC teams need to act on

TL;DR: Flashpoint’s Global Threat Intelligence Report records 7.4M infected hosts and devices and 1.7B stolen credentials in H1 2026, showing that infostealers now power identity-first intrusion at industrial scale. The result is a governance problem, not just a malware problem: trust must move from static login proof to continuous credential and session control.

Editorial analysis by NHI Mgmt Group, based on content published by Flashpoint: “Global Threat Intelligence Report: 2026 Midyear Edition”.

By the numbers:

• Flashpoint recorded 7.4M infected hosts and devices globally in the first half of 2026.
• Flashpoint reports a 27% period-over-period increase in information-stealing malware operations.
• Flashpoint says over 22M AI-related illicit discussions appeared in underground forums.

Key questions

Q: What breaks when attackers can reuse stolen cloud credentials in SaaS environments?

A: When stolen credentials work in SaaS, the organisation loses the assumption that authentication proves legitimacy.

Q: Why do infostealers make session revocation more important than password resets?

A: Because attackers often use session cookies and tokens that remain valid even after a password change.

Q: What signs suggest stolen credentials are being operationalised, not just collected?

A: Look for suspicious login attempts from unusual geographies, repeated authentication against cloud and SaaS services, and evidence that exposed sessions are being tested at scale.

Practitioner guidance

• Implement continuous token revocation policies Revoke active endpoint tokens and cloud sessions automatically when exposed credentials or session artefacts are identified in underground logs.
• Harden browser and endpoint credential storage Disable credential caching in enterprise browsers and review local storage of authentication artefacts on managed endpoints.
• Adopt phishing-resistant authentication Prioritise hardware-backed authentication methods for high-value accounts and remove reliance on reusable passwords where possible.

Bottom line: Infostealers are now a primary identity-exposure mechanism because they collect reusable credentials and live sessions at scale.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →