Below, we follow that attack chain: what infostealers take, how the access gets resold, how it played out in three documented breaches, and where defenders can step in.”
Why infostealers matter
Infostealer malware is designed to quietly gather valuable information from an infected device. Most are built to collect what they can and leave, not to stay on the machine. That smash-and-grab approach is part of what makes infostealers so easy to miss: by the time anyone looks, there may be nothing left running to find.
A typical haul can include any of the following:
- Passwords and browser credentials
- Session cookies and authentication tokens
- Email and VPN credentials
- Cloud account information
- Cryptocurrency wallets
- Sensitive files and application data
Often, the most valuable thing an infostealer takes isn't a password. It's an active session.
While a stolen password can still run into an MFA prompt, a session cookie was issued after the user already passed MFA. Depending on how an application binds and expires sessions, replaying that cookie can drop an attacker straight into a logged-in account. That's why "reset the password" on its own is not a complete response.
What an infostealer collects is enough to impersonate your users, and that access has a buyer.
The initial access economy
Infostealers are often the precursor to a much larger attack. The simplest version of the attack chain is one where a single threat actor is doing everything: infect, steal, log in, deploy ransomware.
In practice, the work is often split between multiple parties where one attacker enables another through the underground market. Stolen credentials can be harvested by one threat actor and sold to Initial Access Brokers (IABs), who then sell access to a different ransomware affiliate. Each group specializes in one step and gets paid for it, which keeps the pipeline moving faster than any single attacker could on their own.
Infostealer → Stolen credentials → Initial Access Broker → Ransomware
A handful of families have done most of the heavy lifting in the stealer economy over the past few years:
Infostealer
| Why it matters
|
RedLine
| Large-scale historical credential theft ecosystem
|
Raccoon
| Malware-as-a-service model and broad credential theft
|
Vidar
| Browser, credential and cryptocurrency data theft
|
Lumma
| Mature stealer with extensive information collection
|
StealC
| Modern stealer used in recent social-engineering campaigns
|
Atomic/AMOS
| Significant threat targeting macOS users
|
While new infostealer families continue to emerge, the business behind them stays the same. Steal someone's access and monetize it.
The real-world connection
Stolen credentials and identity-based compromise have become one of the most common ways attackers get in. This model has been the starting point for several notable breaches:
Snowflake — (2024)
When attackers accessed a long list of Snowflake customer environments, Mandiant traced the credentials back to infostealer infections on systems outside Snowflake. Snowflake itself wasn't breached. The attackers simply logged in with credentials that had already been stolen. Mandiant report.
Endpoint infection → Credential theft → Cloud access → Data theft
StealC and Qilin — (2025)
Sophos described a campaign where victims were tricked by a fake "I am not a robot" check, a technique known as ClickFix, into running a command that installed StealC V2. About a month later, Qilin ransomware was deployed. Sophos report.
Initial compromise → Information theft → Ransomware
Microsoft Storm-0501 — (2024–2025)
Microsoft documented Storm-0501 using stolen credentials to move from on-premises environments into Microsoft Entra ID and the cloud, eventually leading to ransomware activity in the cloud itself. Microsoft report.
Credential theft → Cloud identity compromise → Persistence → Ransomware
Where MFA stops helping
All three cases raise the same question: if stolen credentials are the starting point, shouldn't MFA have stopped them?
MFA is still one of the best defenses against stolen passwords, and every account that matters should have it. But attackers have adapted. Instead of fighting the MFA prompt, they go around it.
That can mean replaying a stolen browser session, reusing an authentication token, or working from a device that's already compromised. It can also mean going after people and processes: talking a help desk into resetting someone's MFA, or getting a user to approve a malicious OAuth app that keeps its access long after a password changes.
None of these look like a break-in. To most tools, they look like legitimate user activity. That's why catching them depends on watching how identities behave, not just scanning for malware.
