Stolen credentials are now the most common way attackers get into organizations. Verizon’s 2025 Data Breach Investigations Report found that credential abuse was the leading initial access vector, involved in about 22% of breaches, ahead of vulnerability exploitation and phishing. Behind that number sits an industrial supply chain: malware that harvests passwords and session cookies from millions of computers, and marketplaces that sell them to whoever wants in.

Many of those computers have antivirus or EDR installed. Infostealers are designed to run briefly, grab what is stored in the browser, and exit, often before endpoint tools react. And many of the infected devices are not company machines at all but personal laptops where an employee once logged into work email. This article explains how the credential theft pipeline works and what actually reduces the risk.

How infostealers feed the market

Infostealers are sold as subscription services to criminals who distribute them through fake software downloads, cracked applications, malicious ads, fake CAPTCHA pages and phishing. Once running, they collect saved passwords, browser cookies and session tokens, autofill data, cryptocurrency wallets and system details, package them as a “log,” and upload it to the operator.

LummaC2, also called Lumma Stealer, was one of the most prolific on Windows. In May 2025 Microsoft’s Digital Crimes Unit, the US Department of Justice, Europol and partners disrupted its infrastructure, seizing or taking down about 2,300 domains. Microsoft said it had identified more than 394,000 Windows computers infected with Lumma in just the two months before the action. On macOS, Atomic Stealer (AMOS) fills the same role, typically disguised as popular software and tricking users into entering their system password.

The resulting logs are sold on dark-web markets and Telegram channels, sometimes within hours. Buyers include initial access brokers, ransomware affiliates and business email compromise crews. Verizon’s analysis of infostealer logs found that 30% of compromised systems were enterprise-licensed devices, while 46% of the systems holding corporate credentials were non-managed, meaning personal or unmanaged devices outside the company’s controls.

Why MFA alone does not stop it

Multi-factor authentication stops a stolen password from being enough. It does not stop a stolen session. When a user logs in and completes MFA, the application issues a session cookie or token so the user does not have to authenticate again for hours or days. Infostealers take those cookies. An attacker who imports one into their own browser can be logged in as the user without ever seeing an MFA prompt.

Once inside a SaaS account, attackers read email to set up invoice fraud, register their own MFA devices for persistence, grant OAuth consent to malicious apps, or move into connected systems. The 2024 campaign against Snowflake customer accounts showed the scale this can reach: attackers used credentials largely harvested by infostealers, some of them years old, to access accounts that lacked MFA and steal data from many organizations.

Credential theft also powers social engineering. Groups such as Scattered Spider combine purchased credentials with help-desk impersonation to reset MFA; we cover their methods in Scattered Spider isn’t gone.

A defense program that matches the threat

1. Move to phishing-resistant, passwordless authentication. Passkeys and FIDO2 security keys cannot be phished, and there is no reusable password for an infostealer to take. Start with administrators, finance and remote access.
2. Shorten and bind sessions. Reduce session lifetimes for sensitive applications, require reauthentication for high-risk actions, and use conditional access policies that tie sessions to compliant, managed devices. Where your identity provider supports token binding or continuous access evaluation, turn it on.
3. Control where corporate logins happen. Block access to company SaaS from unmanaged devices, or allow it only through a managed browser or virtual desktop. This addresses the 46% problem directly.
4. Stop saving passwords in browsers. Use an enterprise password manager, and disable browser password storage by policy on managed devices.
5. Monitor for exposed credentials. Use identity threat detection and a credential exposure monitoring service that watches infostealer logs and breach dumps for your domains, and act on hits by resetting passwords and revoking all active sessions, not just the password.
6. Harden browsers and endpoints. Restrict software installation to approved sources, block known malicious ad and download domains, and make sure EDR is tuned to flag bulk access to browser credential stores.
7. Train for the real lures. Teach employees that “free” or cracked software, fake update prompts and pages that ask them to paste commands are common infection routes, and that logging into work accounts on family computers carries real risk.

Responding when credentials are exposed

When monitoring shows a user’s credentials in an infostealer log, treat it as a device compromise, not just a password problem. Revoke all sessions and refresh tokens, reset the password, review and remove any newly registered MFA methods, check mailbox rules and OAuth app consents, and find the infected device. If it is personal, the user needs clear guidance to clean it before using it for work again.

Write this into your incident response plan as a standard playbook so the steps happen the same way every time, including out of hours. Track a few measures to show progress: the share of users on phishing-resistant authentication, the number of exposed-credential alerts each month, and the time from alert to full session revocation. Those three numbers tell leadership far more about identity risk than a count of blocked login attempts, and they make it easy to see whether investments in passkeys and device controls are paying off.

The trade-off in all of this is convenience. Shorter sessions, device restrictions and passkey enrollment add friction, and some users will push back. Rolling out in phases, starting with the most privileged and most targeted roles, keeps the disruption manageable while covering the highest risk first. Our cybersecurity and compliance services include identity hardening programs built around this sequence.

Frequently asked questions

If our EDR is working, how do infostealers still get through?

Many infections happen on personal or unmanaged devices where your EDR is not installed. On managed devices, stealers are frequently repacked to evade signatures and run for only seconds. EDR helps, but identity controls must assume some credentials will leak.

Does resetting a password fix a stolen session?

Not always. Depending on the application, existing sessions and refresh tokens may remain valid. Explicitly revoke sessions in your identity provider and in critical SaaS applications.

Did the Lumma takedown solve the problem?

It disrupted one major operation, but the infostealer market is crowded and operators rebuild. Security researchers reported Lumma activity recovering within months, and other stealers filled the gap. Plan on the threat continuing.

Protecting identities before they are sold

Delana Technologies helps organizations detect credential exposure, deploy phishing-resistant authentication and lock down session and device access across Microsoft 365, Google Workspace and SaaS platforms. For more on how attackers are scaling these techniques, see AI-powered threats. To review your identity defenses, call 239.414.5126 or contact us.

---

Sources: Verizon 2025 Data Breach Investigations Report; Microsoft On the Issues and Microsoft Security Blog on the Lumma Stealer disruption (May 21, 2025); Europol announcement on the Lumma disruption (May 2025); Mandiant reporting on the Snowflake customer account campaign (June 2024); Trend Micro research on Lumma’s resurgence (2025).