Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Infostealers are an important supply channel for identity-enabled attacks, but they are not proven to be the cause of every identity incident or of a single, globally measured surge. Malware on a user device can copy passwords, browser cookies, session data, personal information and system details. Criminals then package and resell those records, allowing another actor to sign in with a valid credential or token and continue into cloud services.
The practical response is layered: phishing-resistant multifactor authentication (MFA), endpoint and identity monitoring, rapid session and authentication-method revocation, and an incident process that treats browser-session theft as seriously as password theft.
What an infostealer gives an attacker
An infostealer is malware designed to collect information from an infected computer. The target is not limited to a password database.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →- Credentials: saved browser passwords, application logins and other authentication data.
- Session material: browser cookies and tokens that represent an already authenticated session.
- Personal and financial data: autofill information and, in some families, cryptocurrency-wallet data.
- System context: device details and other information that helps criminals choose useful accounts or prepare a follow-on intrusion.
Microsoft’s 2025 Digital Defense Report says Lumma Stealer could retrieve sensitive data from browsers and applications, including cryptocurrency wallets. The FBI and CISA LummaC2 advisory also describes theft of credentials, cookies and other sensitive information. A log containing a username and password is useful; a live session cookie can be even more valuable because it may represent a session that has already passed an authentication challenge.
#1 Best Overall
How do infostealers lead to account takeovers?
The malware-to-intrusion process usually involves different criminal roles rather than one actor performing every step. The following sequence explains the pathway without implying that every incident follows every stage.
- Initial infection: A user runs malware delivered through a malicious download, attachment, advertisement, cracked software or social-engineering lure.
- Collection: The infostealer reads browser stores and applications, captures cookies or session data, and gathers personal and system information.
- Packaging: The malware operator sends the information to an infrastructure or account commonly called a log. Records may include the victim’s device, browser, location and available credentials.
- Resale or distribution: Access brokers or other criminals buy the records. Microsoft reports that data stolen by Lumma was sold to access brokers who could pass it to criminals seeking entry to target networks.
- Valid sign-in: A downstream actor tries the credentials or reuses a token against an email, identity provider, remote-access service or cloud application.
- Expansion: Once inside, the actor may add an authentication method, inspect Microsoft Graph or other cloud APIs, and collect files or email. Whether that succeeds depends on token lifetime, conditional-access controls, device checks, permissions and detection.
This is a criminal supply chain, not a claim that every cloud compromise began with an infostealer. Microsoft’s incident reporting and the Lumma findings describe related stages and consequences, while individual cases require their own evidence.
Can stolen browser cookies bypass MFA?
They can sometimes let an attacker reuse an authenticated session without completing the normal MFA prompt again. A cookie or token is evidence of an existing login, not a new password. If the service accepts it and does not require reauthentication, device binding or another risk check, the attacker may enter the account as the victim.
Free tools Windows power users keep installed
One-click scans. No signup required.
That is not a universal MFA bypass. Sessions expire, providers can revoke them, and policy controls may require a fresh sign-in or restrict use to a managed device. MFA still substantially reduces the value of a stolen password; it does not by itself guarantee that an already issued session cannot be abused. This is why response plans must include session revocation, not just a password reset.
What current figures show—and what they do not show
Available numbers come from different providers, time windows and datasets. They indicate substantial activity, but they do not share a common denominator for “identity attacks caused by infostealers.”
| Source and period | Reported finding | How to interpret it |
|---|---|---|
| Microsoft, Digital Defense Report 2025; observations from October 2024 through October 2025 | Lumma Stealer was the most prevalent infostealer Microsoft observed in that period. | Microsoft telemetry, not a count of all infections worldwide. A mid-2025 operation with the U.S. Department of Justice, Europol and Japan’s Cybercrime Control Center seized or blocked more than 2,300 malicious domains; that disruption did not eliminate the broader infostealer threat. |
| Palo Alto Networks Unit 42, 2026 Global Incident Response Report; 2025 response engagements | Identity weaknesses played a material role in almost 90% of Unit 42 investigations. The report covers more than 750 major cyber incidents; 87% of those engagements involved multiple attack surfaces and 48% involved browser-based activity. | These are characteristics of Unit 42’s incident-response sample, not percentages of all global breaches or a measurement of incidents specifically caused by infostealers. |
| SpyCloud, 2025 Identity Exposure Report; analysis of data it recaptured in 2024 | More than 18 million unique malware-infection logs, 548 million malware-exfiltrated credentials and an average of 44 exposed credentials per infection. The report also says malware siphoned 17 billion cookies. | SpyCloud’s recaptured dataset is not a census of infections, people, valid sessions or successful account compromises. “Cookies” does not mean 17 billion unique users or active logins. |
These reports support a growing concern about the credential-and-token supply chain. They do not establish a globally representative rate, or prove that infostealers are the sole cause of an increase in identity-enabled attacks.
What identity-enabled intrusion looks like after the login
Unit 42 describes attackers increasingly “logging in” with stolen credentials and tokens, exploiting fragmented identity environments to escalate privileges and move laterally. That observation explains why a conventional malware alert is not the only signal defenders should watch.
In a September 9, 2026 incident report, Microsoft described active cloud intrusions observed since May 2026. The sequence included unusual sign-ins, threat-actor-added authentication methods, Microsoft Graph activity, downloads from SharePoint and OneDrive, and email collection. Microsoft advises investigating identity, Graph, SharePoint, OneDrive and Exchange signals together. The pattern illustrates what compromised identities can enable; it does not prove that those cases started with infostealer infections.
How can organizations reduce the risk from stolen credentials?
Require MFA, prioritizing phishing resistance
Enable MFA on important accounts, then move high-value users and administrators to phishing-resistant methods. CISA states that FIDO/WebAuthn is the only widely available phishing-resistant authentication and explains that it can block an attempt to authenticate to a fake website. CISA’s general guidance ranks physical security keys and number-matching authenticator applications more strongly than one-time codes sent by text or email.
A physical FIDO/WebAuthn security key is an optional control for accounts that support it. Before deployment, verify the account’s protocol support, USB or wireless requirements, enrollment and recovery process, device compatibility and organizational policy. A key protects the authentication step; it does not clean an infected endpoint or guarantee that previously stolen sessions cannot be used.
Monitor identity and cloud behavior together
- Alert on unusual sign-ins, impossible or unexpected locations, unfamiliar devices and abnormal application consent.
- Monitor enrollment or changes to authentication methods, especially soon after a suspicious login.
- Review token and session activity, Microsoft Graph calls and unusual downloads from SharePoint, OneDrive or Exchange.
- Correlate endpoint detections with identity events so a stolen browser log is not treated as an isolated malware alert.
Reduce the value of a stolen log
- Use managed browsers and devices where practical, with endpoint protection and timely patching.
- Limit administrative privileges and separate high-impact administrative accounts from everyday browsing.
- Apply conditional-access or equivalent controls that evaluate device, location, risk and session age.
- Remove unused accounts, applications and authentication methods, since dormant access can be valuable to a buyer of stolen data.
What to do when compromise is suspected
Act on the possibility of session theft, not only password exposure.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11- Contain the endpoint: Isolate the suspected device using your endpoint tooling or network controls while preserving relevant evidence.
- Protect the identity: Reset affected credentials from a known-clean device and revoke active sessions and refresh tokens according to the identity provider’s procedure.
- Remove persistence: Inspect and remove authentication methods, app registrations, forwarding rules or other changes the attacker added.
- Trace cloud activity: Review sign-ins, Graph calls, SharePoint and OneDrive access, Exchange activity, privilege changes and downloads across the relevant time window.
- Scope related accounts: Search for reuse of the same credentials, browser logs or authentication methods in other users and services.
- Use threat intelligence carefully: The FBI and CISA LummaC2 advisory contains threat details, indicators and mitigations. Validate indicators against current intelligence and your own environment before operational use.
Microsoft’s cloud guidance specifically recommends investigation across identity and cloud signals, revoking sessions and removing unauthorized authentication methods after a confirmed compromise.
Why a single product is not a complete answer
A password manager, security key, endpoint product or identity platform can address an important part of the problem, but none alone covers infection, data resale, session abuse, cloud reconnaissance and response. The controls that matter most are layered: hard-to-phish authentication, protected endpoints, least privilege, useful telemetry and a practiced revocation-and-investigation procedure.
Bottom line
Infostealers help turn an infected device into a source of reusable identity material. Their logs can feed access brokers, and stolen passwords or sessions can support cloud intrusion. Provider reports show the scale and importance of that pathway, but they do not provide one globally representative percentage of identity attacks caused by infostealers. Organizations should treat browser-session data as sensitive, deploy phishing-resistant MFA where possible, monitor identity and cloud activity together, and revoke sessions and unauthorized authentication methods quickly when compromise is confirmed.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
