Infostealer
Malware that harvests credentials, session cookies and browser data in bulk from an infected machine, whose resale feeds the initial access of many attacks months later.
An infostealer is malware designed to collect, within seconds, everything an infected machine holds that is useful to an attacker: passwords saved in browsers, session cookies that allow login without a password or second factor, cryptocurrency wallets, access tokens for cloud services. It is often spread through fake software, rigged extensions or malicious ads, and frequently hits an employee's personal computer also used for work. Stolen data is sold in batches on specialized marketplaces, then bought by access brokers or ransomware affiliates. For insurance, this link explains two phenomena. Intrusions occur at companies that seem well protected, because the credential came from a machine they did not control. And the delay between theft and attack can exceed a year, which complicates dating the triggering event. It also justifies requiring multi-factor authentication resistant to session theft and monitoring credential leaks in applications.
In 2024, a campaign targeted customer accounts on a cloud data platform: the attackers used credentials stolen by infostealers, some as early as 2020, to access the data of about 165 organizations whose accounts did not require multi-factor authentication. One of the telecom operators affected reportedly paid about 370,000 dollars to have the stolen data deleted.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.