LokiBot is a malicious infostealer used to harvest credentials and other sensitive data from infected devices. Technically, it targets browsers, email clients, and system stores to capture usernames, passwords, cookies, and tokens, then sends them to an attacker-controlled server for reuse in fraud, account takeover, and lateral access.
What LokiBot Means in Practice
LokiBot is a credential-theft infostealer, so its core significance is not the malware name itself but the access it can unlock. By pulling usernames, passwords, browser cookies, and session tokens from common endpoints, it turns infected hosts into reusable identity compromise events rather than isolated device infections.
Why LokiBot Is Dangerous
The danger comes from the kind of data it targets. Browser stores, email clients, and local secret caches often hold enough material for account takeover without any password cracking, which means a single successful infection can bypass normal login friction and undermine trust in supposedly authenticated sessions. That makes LokiBot especially useful for fraud, persistent access, and follow-on intrusion.
How LokiBot Theft Turns Into Reuse
Harvested credentials are usually only the first step. Attackers can replay stolen cookies or tokens, test recovered passwords against other services, and use compromised email accounts to reset passwords elsewhere. In practice, the malware creates a chain from endpoint compromise to broader identity abuse, including lateral access across connected systems.
What Organizations Should Watch For
Exposure is highest where endpoints lack strong browser isolation, credential protection, or monitoring for unusual account use. Organisations should assume that any device contacted by LokiBot may have leaked more than just a password, because modern infostealers often capture live session material that remains useful even after an immediate password change.
Risk and Threat Considerations
LokiBot is dangerous because it converts a single compromised device into reusable authentication material that can survive beyond the original infection. That creates account takeover risk, session replay risk, and downstream compromise of email, SaaS, and internal systems that trust the stolen material.
Failure mechanism: The malware extracts secrets from local stores and active sessions, then sends them to an attacker-controlled server for reuse before defenders can contain the endpoint.
Impact: Stolen credentials and tokens can enable fraud, unauthorized access, privilege escalation through mailbox or reset abuse, and wider lateral movement.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5, CIS Controls v8, NIST CSF 2.0 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1003 — OS Credential Dumping | LokiBot’s credential harvesting aligns with credential access techniques. |
| T1539 — Steal Web Session Cookie | LokiBot targets cookies and tokens that enable session reuse. | |
| Recommendation — Map infected hosts for credential-access activity and hunt for dumping or browser-theft indicators. Monitor for stolen-session reuse and invalidate exposed sessions quickly after containment. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Credential theft directly affects authenticator lifecycle, rotation, and revocation. |
| AC-7 — Unsuccessful Logon Attempts | Stolen credentials are often tested through repeated login attempts and account abuse. | |
| Recommendation — Rotate and revoke exposed authenticators, tokens, and cached secrets after suspected compromise. Correlate abnormal login failures and account-use anomalies to detect credential replay. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | Infostealer-driven account takeover is an access-control failure mode. |
| CIS-8 — Audit Log Management | Detection of credential theft and reuse depends on usable authentication and session logs. | |
| Recommendation — Remove exposed access paths and review accounts that may have been used after theft. Centralize and review authentication and session logs for signs of token or cookie replay. | ||
| NIST CSF 2.0 | DE.CM-03 — Personnel Activity Monitoring | Unusual account and session activity is a key signal after credential theft. |
| RS.RP-01 — Response Plan Execution | Credential-theft malware requires a coordinated containment and recovery response. | |
| Recommendation — Continuously monitor account activity for anomalous sign-ins and post-theft misuse. Execute the incident response plan for suspected credential compromise and session theft. | ||
| OWASP ASVS | V6 — Authentication | The malware undermines authentication material and session trust. |
| V7 — Session Management | Stolen cookies and tokens are directly a session-management concern. | |
| Recommendation — Harden authentication flows and reduce reliance on reusable credentials where possible. Shorten session lifetimes and invalidate sessions when compromise is suspected. | ||
Practitioner Guidance
Why practitioners should care: Response should focus on the identity material exposed, not only on malware cleanup. If LokiBot is confirmed or strongly suspected, treat browser credentials, email access, and any cached session data as potentially compromised and invalidate trust in those secrets.
Common misunderstanding: A password reset alone is often not enough when cookies, tokens, or synchronized browser data may already be in attacker hands. The operational question is whether the attacker can still reuse existing sessions or pivot through accounts that were authenticated before detection.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 24, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org