Infostealer Logs Fueling Enterprise Breaches, Bypassing MFA
Stolen credentials and session cookies from infostealer malware are now the primary vector for enterprise breaches, enabling threat actors to bypass multi-factor authentication and gain direct access to cloud services.
Infostealer malware has quietly become the single most important initial-access commodity in the cybercrime economy, replacing traditional phishing and exploit-driven intrusions as the leading precursor to enterprise breaches and ransomware. Rather than breaking into networks, modern threat actors buy their way in by purchasing "stealer logs" containing valid usernames, passwords, session cookies, and SSO tokens harvested from infected endpoints. These logs are then replayed directly against cloud consoles, SaaS platforms, and VPN gateways, effectively bypassing multi-factor authentication (MFA) through session hijacking.
Cisco Talos' Q1 2026 incident-response data confirms that phishing and credential-based access have overtaken exploit-driven intrusions as the top initial-access vector. Crucially, the credentials involved are overwhelmingly derived from stealer logs. This trend highlights a significant shift in attacker methodologies, moving from technical exploits to exploiting the human element and the readily available underground market for stolen credentials.
The 2024 Snowflake breach serves as a canonical case study of this pipeline. Threat actor UNC5537 (aka Scattered Spider/ShinyHunters) did not exploit a Snowflake vulnerability. Instead, they utilized credentials harvested by infostealer malware from Snowflake customer employees. Some of these infections dated back to 2023, with passwords found stored in unsecured spreadsheets and password managers. The absence of MFA on the compromised accounts allowed attackers to log in using only stolen credentials. This campaign ultimately affected at least 165 organizations, including major companies like AT&T, Ticketmaster, and Santander Bank, exposing billions of records and driving significant extortion demands.
A more recent example is the Zestix/Sentap campaign identified in January 2026. This operation leveraged credentials harvested by RedLine, Lumma, and Vidar infostealers to breach corporate accounts on cloud file-sharing platforms such as ShareFile, Nextcloud, and OwnCloud. The attackers exfiltrated sensitive data, including defense engineering blueprints and healthcare records, again without relying on any exploits, solely using stolen credentials and the lack of MFA.
Flare's 2026 State of Enterprise Infostealer Exposure report quantifies the scale of this problem. In 2025 alone, over 2.05 million infostealer logs exposed enterprise identity credentials. The proportion of enterprise identity exposure within infected logs rose from approximately 6% in early 2024 to nearly 16% by 2026. Alarmingly, 79% of these enterprise logs contained Microsoft-linked SSO credentials. Furthermore, about 1.17 million logs contained both credentials and live session cookies, providing immediate access that bypasses MFA entirely through session replay.
The pipeline from infection to breach typically involves five distinct stages, often executed by different specialized actors within the cybercrime supply chain. The process begins with infection, where a user, often on a personal or unmanaged device, executes the stealer payload through low-effort, high-volume lures. The malware then collects browser-stored passwords, session cookies, autofill data, crypto wallets, and system fingerprints, packaging them into a "log" per victim device. This log is exfiltrated, frequently via the Telegram Bot API, which has become a dominant Command and Control (C2) channel due to its low cost, resilience, and ability to blend into normal traffic.
These logs are then sold in bulk on automated marketplaces for as little as $1–$50 per log. Initial Access Brokers (IABs) purchase these logs in high volume, filter them for enterprise VPN, SSO, or cloud-admin credentials, verify the access, and resell it privately to ransomware affiliates for prices ranging from $500 to $5,000, depending on the privilege level and target sector. The compressed timeline, with credentials often moving from theft to underground listing within 48 hours and ransomware affiliates weaponizing purchased access within another 48 hours, underscores the critical need for continuous credential-leak monitoring, not just periodic password rotation, as a baseline defense requirement.
Infostealer operators in 2026 have largely abandoned exploit-based delivery in favor of social-engineering lures optimized for volume. Common infection vectors include fake CAPTCHA pages that trick users into executing PowerShell commands, trojanized cracked software distributed via SEO-poisoned search results, fake browser or codec updates, malvertising, malicious YouTube tutorial links, phishing emails with malicious attachments, and increasingly, malicious npm or open-source packages designed to seed stealers on developer machines.