Infostealer malware has been the engine of the credential crisis for three years. The volume of stolen credentials in criminal markets continues to grow. The downstream effects in breach data and account takeover incidents are running months behind the harvest. Defenders are still catching up to a problem that has been operating at scale for a long time.

What is being stolen

The current generation of infostealers captures more than just passwords. They take session cookies and tokens, autofill data, cryptocurrency wallet files, browser-stored payment information, application-specific data from messaging clients, and system telemetry that helps attackers establish persistence.

The session cookie capture is particularly damaging because it bypasses multi-factor authentication. A stolen session cookie can be used to access accounts without re-authenticating, and the duration of usability is limited only by the session lifetime configured by the application.

Where the data flows

The harvested data flows into criminal markets where it is sold by the log. A log contains the captured data from one infected device. The buyer gets access to whatever the infostealer captured on that device, which may include credentials for dozens of services.

The price per log varies based on quality signals — geographic location of the infection, presence of banking credentials, presence of corporate email accounts, presence of cryptocurrency wallets. Premium logs sell for hundreds of dollars. Bulk logs sell for cents each.

The buyers are diverse. Some operate at scale, working through bulk logs systematically. Others target specific log types for specific purposes — ransomware operators acquiring corporate access, fraud operators acquiring banking credentials, cryptocurrency thieves targeting wallet logs.

The downstream pattern

The compromise lifecycle for an individual infostealer log is typically extended. The log may be sold and resold multiple times. The credentials it contains may be used immediately for some purposes and held for later use for others. The downstream breach attributable to a specific infostealer infection may not surface for many months.

This delay creates a persistent risk overhang. The infections that happened in 2024 and 2025 are still producing breach activity in 2026. The infections happening now will produce breach activity through 2027 and beyond.

Why defences are not catching up

Endpoint protection has improved but the infostealer authors have improved in parallel. The detection-evasion arms race is being run successfully by the attackers as well as by the defenders. Antivirus detection rates on fresh infostealer samples are not high enough to provide reliable protection.

User awareness training is partial protection but does not address the mechanical attack vectors — malvertising, software cracks, fake software updates, supply chain compromises of legitimate software.

The hardening that genuinely helps is at the credential level rather than the endpoint level. Phishing-resistant authentication. Short session lifetimes. Continuous authentication signals that detect anomalous session use. Most organisations have not implemented these at the scale required.

What is genuinely effective

Three things. Phishing-resistant authentication using FIDO2 or platform authenticators is highly effective against credential theft because the stolen credential cannot be replayed. Session anomaly detection, which flags use of valid session tokens from unexpected geographic or device contexts, catches a meaningful subset of session token reuse attacks. Aggressive session lifetimes, which limit the window during which a stolen session token is useful, are operationally inconvenient but reduce risk substantially.

The combination of these three controls makes infostealer-driven account compromise materially harder. The combination is not common.

What is next

The infostealer ecosystem continues to professionalise. The malware-as-a-service operators are mature businesses with customer support, regular updates, and competitive differentiation. The supply of compromised data will continue to grow.

The defensive response has to move beyond endpoint-centric thinking. The credential crisis is not going to be solved by detecting infostealers. It is going to be solved by making the credentials they steal less useful.