An infostealer is malicious software that copies what the browser stores (saved passwords, session cookies, and autofill data) and sends it to the attacker within seconds. These packages are sold on underground markets and allow attackers to enter the company using a valid login.
The infected computer is rarely a corporate one. It is often the personal laptop an employee used to access company email.
How infection happens
The infostealer arrives disguised as what the person was looking for: pirated software, a browser extension, an ad imitating a well-known software website, or a link to a free version. The person installs it without realizing what they are installing.
There is no ransom screen or noticeable slowdown. The program collects data and often deletes itself afterward. Vultus discussed the topic in a Forbes article on infostealers.
What gets stolen and why a second factor may not be enough
The infostealer takes every password saved in the browser, personal and corporate, along with enough device information for the attacker to impersonate the user. It also takes session cookies, which keep users logged in after the second factor. With these, the attacker can resume an authenticated session without a password or phone code.
Session theft also appears in phishing campaigns, the subject of the article Phishing: cybercriminals are no longer fishing only for credentials.
What testing finds
In the 2026 Cyber Risk Landscape, a Vultus study of 132 organizations across 11 sectors, credentials captured by infostealers accelerated intrusion in 21.4% of tests. In 38.1% of organizations, a cloud environment lacked multifactor authentication, making a stolen password sufficient on its own.
Both figures describe an entry path requiring no vulnerability exploitation or advanced technique.
International reports confirm the trend. ENISA identifies infostealers as a recurring vector behind larger attacks in Europe, and M-Trends 2026, from Google Cloud, recorded stolen credentials in 16% of intrusions into cloud environments.
Fictional example: the family laptop
A finance manager at a distributor uses the family laptop to review a spreadsheet on Sunday and saves her corporate email password in the browser. Weeks earlier, a video downloader installed on the same device brought in an infostealer.
On Monday, the credentials and active session are for sale. On Friday, someone uses the session to read vendor conversations and send a request to change the bank account for payment from her legitimate address.
What the company can do
The most direct measures are:
- Monitor leaked credentials: to know a password was leaked before someone uses it.
- Revoke sessions: changing the password does not invalidate an already stolen session.
- Block corporate passwords in the browser: with a corporate password manager as an alternative.
- Require a second factor: across everything accessible from outside the network.
- Shorten critical sessions: a session that expires within hours is worth less to an attacker.
- Rules for personal devices: or an isolated work environment.
Curated monitoring
Vultus monitors leaked credentials across surface web, deep web, and dark web sources, with curation that links each credential to the system it accesses and the date of the leak. When integrated with the SOC, a login using a leaked credential triggers a high-priority alert. Explore Vultus threat intelligence and prevention and read about identity and access management.
