Infostealer credential harvesting

Infostealer credential harvesting is the theft of saved passwords, session cookies, and tokens from an infected endpoint by commodity malware such as Lumma, RedLine, Vidar, and RisePro, followed by resale of the resulting "logs" on criminal markets. It is the most common single technique in SWI's Identity Breach Database after secrets in repositories: 10 incidents, including the 2024 Snowflake campaign. When Microsoft disrupted Lumma in May 2025, it had identified over 394,000 infected Windows computers in two months for that one family alone.

How it works

1. Infection. The user runs something: a cracked game, a trojanized AI tool, a fake installer from a search ad, a poisoned package, or a "fix" pasted into a terminal. Mandiant found several Snowflake-linked infections began on contractor laptops also used for gaming and pirated software.
2. Collection. The stealer reads the browser's saved-password database, cookie store, and autofill data. Microsoft lists Lumma's haul as login credentials, payment card details, bank account information, and cryptocurrency wallets; developer tokens are in scope too, as the GitHub OAuth tokens in the Shai-Hulud case below show. Browser stores have historically been protected only by keys the logged-in user can already use, so a process running as that user could decrypt them without privilege escalation. Chrome's App-Bound Encryption on Windows raised that bar for cookies in 2024, as covered in session cookie theft.
3. Exfiltration. The bundle, a "log", leaves in seconds, usually before any scheduled scan.
4. Resale. Logs are sold individually or in bulk and searched by domain. Buyers filter for corporate SSO portals, data platforms, and admin consoles.
5. Use. Passwords go to any login without MFA or with phishable MFA the buyer can social-engineer around. Cookies go straight into the attacker's browser as a live session; that path is covered in session cookie theft.

The credentials outlive the infection. Mandiant's UNC5537 report traced the earliest credential used in the Snowflake campaign to an infostealer infection in November 2020, found at least 79.7% of the accounts used had prior credential exposure, and noted some credentials had gone unrotated for as long as four years. Connor Riley Moucka pleaded guilty in August 2026 to charges over that campaign, which reached about 165 organizations.

Why it works

The control assumption that fails is that a stored secret is safe because it is stored on the user's own machine. An infostealer does not guess or intercept the password; it reads it the same way the browser does, and the theft generates no failed login anywhere. The second assumption is shelf life. Without a forced rotation tied to an exposure, a password stolen in 2020 is still valid in 2024. The third is device scope. Work credentials synced into a personal browser profile follow the user onto unmanaged machines, which is how the Disney and Nikkei Slack incidents began. Directory-side controls such as lockout and password complexity do nothing here: the attacker arrives with the right password on the first try.

How to detect it

• Exposure monitoring. Commercial services such as SpyCloud and identity provider features such as Microsoft's leaked credentials detection match infostealer logs against your domains and users. Microsoft Defender for Identity surfaces on-premises accounts with leaked credentials as a posture finding. Treat a match on a current password as a confirmed compromise of that credential.
• Endpoint signals. EDR detections of stealer families, or unexpected processes reading browser credential and cookie files, are the only detection at the moment of theft. They see only managed devices.
• First login on a first-try password from new infrastructure, especially on accounts that normally authenticate through SSO and are suddenly used directly against an application's local login.
• Session reuse signals. The same session identifier appearing from a new IP or ASN without a new interactive sign-in.

The honest limit: the theft happens on an endpoint, often a personal one, outside anything the defender can observe. Exposure feeds are large, partly stale, and lag the theft by days to months. This is a trigger for rotation and session revocation, not a detection that fires on the theft itself.

How to stop it

Ranked by effect:

1. Phishing-resistant MFA everywhere a password still works, including service, legacy, and data platform accounts. Every login in the Snowflake campaign used a single factor; Mandiant names missing MFA, missing rotation, and missing network allow lists as the three causes.
2. Require managed, compliant devices for corporate SaaS through conditional access and device posture. A stolen password replayed from an attacker's machine then fails the device check at sign-in.
3. Treat an infection as an identity incident. Revoke every session for the user, rotate every credential the browser held (including personal-profile work credentials), and review new MFA methods and OAuth grants. Clean the machine first or it re-harvests. The Identity Breach Report 2026 ranks this control against 17 of 123 incidents.
4. Bind sessions to the device where the platform supports it (Entra token protection, device-bound session credentials), so stolen cookies stop working off-device.
5. Stop syncing work credentials into personal browser profiles, and prefer passkeys or an enterprise password manager over browser-saved passwords.
6. Short-lived developer and workload credentials. Replace stored cloud keys and long-lived GitHub tokens with federation, as the Shai-Hulud case shows why. See infostealer and the identity incident response runbook.

Seen in the wild

• Snowflake customer tenant extortion campaign (UNC5537) (2024): about 165 organizations notified, with victims including AT&T (call records for nearly all wireless customers), Ticketmaster, Advance Auto Parts (2,316,591 people notified), and Neiman Marcus. Mandiant named VIDAR, RISEPRO, REDLINE, RACOON STEALER, LUMMA, and METASTEALER in the logs. This is a shared-platform campaign, not a fan-out breach: each tenant was entered separately.
• Disney Slack data theft (2024): a trojanized AI art tool on a personal computer yielded the employee's Slack credentials; about 1.1 TB was downloaded.
• Nikkei Slack workspace (2025): malware on an employee's personal PC leaked Slack credentials; data on up to 17,368 people may have been exposed.
• Uber (2022): a contractor's password, likely bought after malware infected a personal device, was combined with MFA push fatigue.
• Hijacked AI coding assistant session spreads Shai-Hulud inside a SaaS provider (2026): an infostealer from a poisoned PyPI package took GitHub OAuth tokens, and the worm reached about 100 internal repositories.
• Nobelium and a Microsoft support agent's device (2021): information-stealing malware on a support agent's machine gave the actor access used for targeted attacks.
• Infostealers and session hijacking, the SWI teardown, and CrowdSec's 170 lost repositories after a laptop token theft.

Sources

• MITRE ATT&CK T1555.003: Credentials from Password Stores: Credentials from Web Browsers
• MITRE ATT&CK T1539: Steal Web Session Cookie
• Mandiant: UNC5537 targets Snowflake customer instances for data theft and extortion (June 2024)
• Microsoft: Disrupting Lumma Stealer (May 21, 2025)
• Microsoft Defender for Identity: accounts security posture assessments
• US Attorney's Office, Central District of California: Disney employee hacking plea