Infostealers Explained: How Stolen Cookies and Passwords Become Company Breaches

Many of the breaches you read about did not start with an exploit. They started with a log file: a few megabytes of passwords, cookies and keys stolen from one laptop and sold to someone who knew which company those credentials opened. Interviewers ask about infostealers because the topic ties malware, identity and incident response together.

What a stealer takes

An infostealer runs once, quickly, and grabs everything useful. That includes browser passwords and session cookies, autofill data, crypto wallets, chat and VPN configuration, and on developer machines cloud CLI credentials, package registry tokens and SSH keys. The result is uploaded as a "log" and sold, often searchable by domain, so a buyer can ask for every log containing your company's single sign-on.

Why MFA is not the answer by itself

MFA protects the login ceremony. A session cookie represents a ceremony that already succeeded, so importing it into a browser makes the attacker the user without a password or a second factor. Long-lived refresh tokens and API keys are worse, because many of them never expire and never involved MFA at all.

Two cases worth knowing

Snowflake customers, 2024. Mandiant traced every breach in the campaign to customer credentials stolen by infostealers, some years earlier, used against accounts that had no MFA and no network allow lists. The platform itself was not breached. It is the clearest example of stealer logs turning into large data thefts.

Takedowns. Law enforcement disrupted the RedLine and META stealers in October 2024. In May 2025, Microsoft and partners seized about 2,300 domains used by Lumma, after counting more than 394,000 infected Windows computers in two months. Takedowns raise costs, but the market moves to other families.

How infections happen now

Cracked software, game cheats and malicious search ads remain common. ClickFix lures have grown fast: a fake CAPTCHA or error message tells the user to press a few keys and paste a command, so the user runs the payload and controls aimed at downloads and macros never see it. Microsoft reported ClickFix campaigns reaching thousands of devices a day in 2025.

Browsers are fighting back

Chrome's App-Bound Encryption made it harder for malware running as the user to decrypt cookies on Windows, but stealers adapted within months. Device Bound Session Credentials change the economics: the session is tied to a key in the TPM, the site issues short-lived cookies only after proof of possession, and a copied cookie soon stops working. Chrome made DBSC publicly available on Windows in 2026. Sites have to adopt it to benefit.

What actually breaks the chain

• Make stolen secrets worthless: phishing-resistant MFA, short sessions for sensitive apps, device-bound sessions where available, no long-lived cloud keys or registry tokens on laptops, and network restrictions on data platforms.
• Keep work on managed devices: conditional access that requires a compliant device, since you cannot clean a personal laptop you do not manage.
• Harden endpoints: application control and script restrictions for standard users blunt ClickFix.
• Watch the market: monitor stealer-log intelligence for your domains and revoke sessions and rotate keys before buyers act.

When your domain shows up in a log, rotate what bypasses MFA first (sessions, tokens, keys), then hunt in sign-in and cloud audit logs from the infection date, not the alert date.

Go deeper

The full scored answer with a what-if ladder is the infostealer economy. For detection of replayed sessions, see detecting stolen session tokens, and for the MFA side, phishing-resistant MFA.