What should organisations do first when infostealer activity is suspected on user endpoints?

Why This Matters for Security Teams

When infostealer activity is suspected, the immediate risk is not just malware on a single endpoint. Stolen browser cookies, password vault data, session tokens, and saved API keys can be replayed long after the device is isolated. That makes identity containment as important as device containment. Current guidance from NIST SP 800-53 Rev 5 Security and Privacy Controls emphasizes rapid response, session control, and credential protection, but infostealers compress the timeline so much that delayed action often fails.

This is also why NHI exposure matters in parallel. NHIMG’s Ultimate Guide to NHIs reports that 79% of organisations have experienced secrets leaks and 91.6% of secrets remain valid five days after notification, which is a clear sign that replayable artefacts often survive incident response. Security teams should treat suspected infostealer activity as an identity incident until proven otherwise, not just an endpoint hygiene issue. In practice, many security teams discover the scope only after harvested session material has already been used across multiple services.

How It Works in Practice

The first response should break the attacker’s ability to reuse anything stolen from the endpoint. That means isolating the device, revoking live sessions, and rotating any credential material that may have been cached, synced, or copied into the browser, password manager, developer tooling, or local files. If the endpoint belongs to a privileged user, the blast radius is larger because infostealers often capture both human credentials and application secrets that are trusted by unmanaged tools.

Operationally, this usually requires action in two planes:

• Device plane: quarantine the host, preserve forensic evidence, and block outbound access that could support additional exfiltration.

• Identity plane: invalidate browser sessions, SSO tokens, refresh tokens, API keys, SSH keys, and any other secrets exposed on the endpoint.

• Trust plane: review unmanaged apps, developer extensions, local scripts, and automation tools that may still accept the stolen artefacts.

For organisations with large NHI estates, this is where the Ultimate Guide to NHIs is especially relevant: once a secret is harvested, any downstream system that trusts it may need revocation or re-issuance. NIST also recommends tightening authentication lifecycle controls in NIST SP 800-53 Rev 5 Security and Privacy Controls, which maps directly to rapid session invalidation and credential replacement.

The practical goal is to make the stolen artefact useless before it can be replayed from a different device, network, or automation path. These controls tend to break down in environments with shared accounts, long-lived browser sessions, or secrets embedded in unmanaged SaaS tools because there is no single place to revoke trust.

Common Variations and Edge Cases

Tighter containment often increases operational disruption, requiring organisations to balance speed against user impact and service continuity. That tradeoff becomes sharper when the suspected endpoint belongs to a developer, administrator, or contractor with broad access.

There is no universal standard for the exact sequence after suspicion, but current guidance suggests the following distinctions:

• Personal devices or unmanaged endpoints: assume local artefacts are already exposed and prioritise account reset, session revocation, and secrets rotation.

• Privileged workstations: treat the event as a potential enterprise-wide identity compromise because the device may hold admin tokens, cloud CLI credentials, and NHI material.

• Shared or VDI environments: confirm whether cached tokens, browser profiles, or synced password stores can persist beyond the isolated session.

Incident handlers should also check whether password resets alone are enough. In many SaaS and cloud services, refresh tokens, OAuth grants, and remembered device trust can outlive a password change. The safer assumption is that any secret or session artefact accessible from the infected endpoint is compromised until explicitly invalidated. For a broader identity context, the Ultimate Guide to NHIs shows why rotation discipline matters across both human and machine identities. The answer breaks down most often in environments where legacy applications cannot revoke sessions centrally, because attackers can keep using stolen tokens even after the endpoint is cleaned.

Related resources from NHI Mgmt Group

• Should organisations prioritise external exposure or internal credential governance first?
• What should organisations do first when formalising supply chain risk governance?
• Which control should organisations prioritise first when attack windows collapse?
• How should organisations balance age assurance accuracy with user friction?