Infostealers were responsible for the theft of over 3.9 billion credentials last year. As businesses become increasingly reliant on digital infrastructure, attackers are refining their techniques to harvest sensitive login data, bypass security measures, and exploit stolen information for financial gain.
The latest data from KELA’s State of Cybercrime 2024 report estimated that at least 4.3 million machines were infected by infostealer malware last year, resulting in over 330 million compromised credentials. With cybercriminals sharing vast repositories of stolen credentials, such as ULP files that contain billions of compromised login details, the risks have never been greater.
For businesses, protecting credentials is pivotal. If an attacker gains access to an employee’s login details, they could infiltrate internal systems, move laterally within the network, and launch devastating attacks, from data theft to ransomware. To mitigate these risks, organisations must adopt a multi-layered security approach, including strong authentication, robust credential management, and endpoint security.
Multi-Factor Authentication is the First Line of Defence
Passwords are no longer enough to secure business accounts. Cybercriminals can easily steal or brute-force weak credentials, and with the rise of infostealer malware, even complex passwords stored in browsers are at risk.
Multi-factor authentication (MFA) is one of the most effective ways to protect against compromised credentials. By requiring an additional verification step, like a one-time passcode (OTP) or biometric authentication, MFA ensures that even if a password is stolen, attackers cannot gain access to an account.
Hardware-backed authentication methods, like FIDO2 security keys or passkeys, provide an even stronger layer of security. These methods rely on cryptographic key pairs stored securely on a physical device, meaning attackers cannot authenticate without access to the hardware. Businesses should prioritise the adoption of FIDO-based authentication to reduce the risks associated with credential theft.
Robust Credential Management Prevents Exposure and Misuse
While MFA is crucial, businesses must also address the way credentials are stored and managed. Many infostealer breaches occur because employees store passwords insecurely, either in plain text, browser password managers, or easily accessible files.
Using a dedicated password manager is essential for secure storage and automatic password rotation. Enterprise-grade password management solutions can generate complex, unique passwords for each account and ensure they are never exposed in unprotected environments. On top of this, businesses should enforce the use of passphrases rather than traditional passwords, as longer credentials are significantly harder to crack.
Beyond password storage, elevation approvals for privileged access can serve as an additional safeguard. If an attacker successfully compromises a credential, access control measures can prevent them from escalating privileges without further authorisation. Implementing just-in-time access and regular audits of privileged accounts will help ensure that only authorised users can perform sensitive actions.
Strengthening Endpoint Security
Infostealer malware usually infiltrates devices through phishing attacks, malicious downloads, or compromised websites. Once installed, the malware extracts saved credentials, browser cookies, session tokens, and autofill data, often exfiltrating the information to cybercriminals within minutes.
To mitigate these risks, businesses should invest in advanced endpoint detection and response (EDR) solutions that can identify and neutralise infostealer infections before they cause serious harm. Traditional antivirus software is often ineffective against modern, sophisticated infostealers, making AI-driven threat detection a necessity. Network segmentation can also limit an attacker’s ability to move laterally if a device is compromised, reducing the overall risk to an organisation.
The Rise of Session Hijacking
Infostealer malware is evolving beyond just password theft. Cybercriminals are targeting active session tokens, allowing them to bypass authentication entirely. Once they obtain a valid session cookie, attackers can hijack an account without needing a password or MFA approval.
Businesses must adapt their security strategies to counteract session hijacking. One approach is to reduce session persistence by enforcing frequent re-authentication, particularly for high-risk accounts. Implementing device-bound session cookies can also help, ensuring that authentication tokens cannot be used outside of the original, trusted device.
Zero-trust security principles play a crucial role in this battle. By continuously verifying user identities, monitoring for unusual activity, and applying adaptive access controls, organisations can prevent attackers from exploiting compromised credentials and session tokens.
Building a Resilient Security Culture
Technology alone is not enough, as human behaviour remains a critical factor in credential security. Employees must be trained to recognise phishing attempts, avoid downloading unverified software, and report suspicious activity immediately. Security awareness training should be an ongoing initiative rather than a one-time exercise.
Regular red teaming exercises and penetration testing can help businesses identify vulnerabilities in their authentication processes and credential management practices. By simulating real-world attack scenarios, organisations can proactively address security gaps before cybercriminals exploit them.
Infostealers are an ever-growing threat, with cybercriminals finding new ways to harvest credentials and infiltrate corporate networks. However, businesses are not powerless. A comprehensive security approach, like MFA, hardware-backed authentication, password management, endpoint security, and continuous monitoring, can significantly reduce the risk of credential compromise.
As attackers evolve, so must our defences. By prioritising proactive security measures and fostering a culture of vigilance, organisations can stay ahead of infostealers and safeguard their most valuable digital assets.
Joel Rennich is the VP of Product Strategy at JumpCloud. He focuses mainly on the intersection of identity, users, and their devices. At JumpCloud, he leads a team focused on device identity across all vendors. Prior to JumpCloud Joel was a director at Jamf helping to make Jamf Connect and other authentication products.
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.