Stolen Credentials: Why Infostealers Are the Easiest Way Into Your Network

TL;DR

• Infostealer malware encrypts nothing and asks for no ransom. It quietly copies saved passwords, session cookies and VPN configurations from one device and passes them on.
• That makes a working login the cheapest way in. An attacker who signs in with a valid account does not have to break anything, and looks like a colleague in your logs.
• Multi factor authentication raises the bar, but a stolen session cookie can walk past it. Coverage and session lifetime decide how much the second factor is really worth.
• Three questions are worth more than any tool: which internet facing systems still accept a password alone, how long a session stays valid, and would anyone notice a login from an unexpected device.

Most conversations about breaking into a company start with vulnerabilities. In practice a large share of incidents begin with something far more boring: someone logs in. The password was correct, the account existed, and nothing was exploited. The credential came from a device that the company never managed, often months before it was used. If you are planning penetration testing for the coming year, this is the path worth understanding first, because it bypasses most of what a scanner looks at.

What an infostealer actually takes

An infostealer is a small program with one job: collect anything that proves identity and send it out. That means the password store of every browser on the machine, saved cookies, autofill data, VPN profiles, saved remote desktop connections, and sometimes files that look like a password list. It runs in seconds and then removes its own traces, so there is no encrypted drive and no ransom note to make anyone suspicious.

The device is usually not a company laptop. It is a private machine with a work login saved in the browser, a family computer where someone checked webmail once, or a contractor system outside your management. The infection route is ordinary: a cracked application, a fake installer for a common tool, a download from a search advert. Your network is never touched, which is exactly why the first signal arrives late.

Why a valid login beats an exploit

An exploit is loud. It leaves crash traces, it fails against a patched system, and it often needs to be adapted for the target. A stolen credential has none of those problems. It works on the first try, it produces a successful authentication event rather than an alert, and it gives the attacker exactly the permissions of the person whose account it is.

There is a second effect that organisations underestimate. People reuse. The password taken from a private device is often close to the one used for the company portal, and the account name is usually the work email address. One credential set therefore opens several doors, and the attacker only needs one of them to be a system with a wide view.

MFA helps, and it is not the whole answer

Multi factor authentication is the highest value control against reused passwords, and it should be everywhere before anything else on this page gets budget. What it does not do is protect a session that has already been authenticated. A session cookie copied from a browser represents a login that already passed the second factor, so replaying it can skip the prompt entirely.

That shifts the useful questions towards session policy: how long tokens stay valid, whether they are bound to a device or a network, and whether a sign in from a new device is treated as an event worth reviewing. It also means MFA coverage has to be complete. One legacy application or one service account outside the policy is enough, and those are the accounts nobody watches.

Worth checking this quarter

• Inventory every entry point reachable from the internet, including VPN, webmail, remote desktop, supplier portals and forgotten test environments, and confirm each one enforces MFA.
• Check session and token lifetimes. A token that stays valid for weeks turns a single theft into long term access.
• Look at service accounts and shared logins separately. They rarely have a second factor and often have more rights than any individual.
• Decide what a login from an unusual device or country should trigger, and test whether that alert actually reaches a person.
• Tell people plainly why saving work logins in a private browser matters, and give them a password manager so the safer option is also the easier one.

Frequently Asked Questions

What is an infostealer?

Infostealer malware copies credentials and session data from a device and sends them to an attacker. It usually arrives through a cracked application, a fake installer or an attachment, does its work in seconds and then cleans up after itself, so the user often never notices anything.

How do attackers get our company passwords if our network was never breached?

Usually from a device you do not manage: a personal laptop with a saved company login, a contractor machine, or a browser password store on a private phone. The credential leaves through that device, and the first sign inside your own network is a login that looks entirely normal.

Does multi factor authentication stop stolen credentials?

It stops most reuse of a plain password, which makes it the single most valuable control here. It does not stop an attacker who stole a valid session cookie, and it does nothing for systems that were never placed behind it. Coverage and session lifetime decide how much protection you actually get.

How do we find out whether our credentials are circulating?

Breach lookup services and your own identity provider logs are the starting point. A structured check belongs in a wider external assessment: penetration testing starts from what is reachable and usable from outside, and exposed credentials are part of that picture.

Is this a technical problem or a people problem?

Both, and they need different answers. Password reuse and installing software from unofficial sources are behaviour, which is what awareness training addresses. MFA coverage, session policy and login monitoring are configuration. Fixing one side and not the other leaves the door open.

Related services and resources

If you want to know which of your entry points still accept a password alone, our penetration testing service maps what is reachable from outside and what an attacker can do with it. For the behavioural half, security awareness covers password reuse and unofficial software in a way people remember. If you suspect a credential is already being used, Am I Hacked? 10 Warning Signs and What to Do Next lists the signals to look for, and How to Solve Phishing Structurally explains the identity controls that limit the damage of any single stolen login.