July 10, 202611 min read

Your Employee's Credentials Appeared in an Infostealer Log: The Response Workflow

Sources:GitGuardian 2026 State of Secrets Sprawl Report|SpyCloud Annual Identity Exposure Report 2025|16 Billion Credentials Leak: Dark Web Exposure Check Guide

Eric Bang

Founder & Cybersecurity Evangelist

16 billion

credentials in the 2025 compilation leak — the largest aggregated credential dump ever recorded, including corporate SSO and SaaS app credentials

1 in 3

enterprise login attempts across monitored environments in 2026 use credentials sourced from prior breach compilations — F5 Labs

48 hours

average time from stealer log publication on underground forums to active credential stuffing campaigns using those credentials

Session cookies

captured by modern infostealers alongside passwords — they bypass MFA entirely and remain valid until the session is explicitly revoked

What infostealer logs contain

Understanding what stealer malware captures determines what you need to revoke.

Browser-saved passwords

Chrome, Edge, Firefox, and Safari all have built-in credential managers that store usernames and passwords for every website the user has logged into. Infostealer malware extracts these directly from the browser's credential database. A single infected workstation typically yields hundreds to thousands of saved credentials — corporate SSO, SaaS applications, personal accounts, and any service the employee accessed via that browser.

Active session cookies

Session cookies are the tokens that keep you logged into a website without re-entering credentials. When a user authenticates through MFA and receives a session cookie, that cookie is valid until it expires (often days to weeks) or is explicitly revoked. Infostealer malware captures these cookies. An attacker with a valid session cookie can import it into a browser and access the session immediately — bypassing both password and MFA because authentication already occurred.

Saved form data and autofill

Browser autofill contains names, addresses, credit card numbers, and other personal information. For corporate accounts, this may include internal system fields that contain organizational data. Less immediately critical than session cookies and passwords but part of the full exposure picture.

VPN and network credentials

Some infostealers specifically target VPN client credential stores: saved passwords in GlobalProtect, Cisco AnyConnect, and similar clients. VPN credentials with stored passwords bypass the primary network perimeter defense.

Subscribe to unlock Remediation & Mitigation steps

Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.

Step 1: Confirm scope of the exposure

When you receive an alert that credentials from your domain have appeared in a stealer log, determine scope before taking action — the correct response depends on what was captured and from which machine.

Identify the affected user and machine

Most dark web monitoring alerts include partial credential information. Match the email address or username in the alert to your employee directory. Identify the workstation most likely to have been the source: the device the employee uses for browser-based work with those credentials. This becomes the forensic investigation target.

Determine what was captured

If your monitoring service or threat intelligence source can provide the specific log contents (some services like SpyCloud, Flare, or Hudson Rock's Cavalier provide full log access for validation), review what credentials and cookies were captured. A log containing only an old LinkedIn password from five years ago warrants a different response than one containing current corporate SSO session cookies.

Assess whether an active session was captured

If the stealer log includes session cookies for corporate SSO (Okta, Entra ID), Microsoft 365, Google Workspace, or any sensitive application, treat it as an active incident. Session cookies are valid until revoked — the attacker may already be using the session if the log was published to underground forums.

Subscribe to unlock Remediation & Mitigation steps

Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.

Free daily briefing

Briefings like this, every morning before 9am.

Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.

Step 2: Revoke sessions — not just passwords

The most common mistake in responding to infostealer exposure is resetting the password without revoking active sessions. An attacker holding a valid session cookie is not affected by a password reset — the cookie authenticates the session independently of the password.

Revoke all active sessions from the identity provider

In Entra ID: Revoke-AzureADUserAllRefreshToken -ObjectId [user-id] (PowerShell) or Users > user > Revoke sessions in the portal. This invalidates all refresh tokens, forcing re-authentication in all Microsoft services. In Okta: Admin > User > More > Revoke Sessions. In Google Workspace: Admin console > Users > select user > Security > Revoke all sessions.

Revoke application-specific sessions in high-risk apps

SSO session revocation handles federated applications. For non-SSO applications where the employee had active sessions (Salesforce, GitHub, AWS console, Jira, Confluence), log into each application's admin console and terminate active sessions for the affected user. In Salesforce: Setup > Users > select user > Remote Access revocation. In GitHub: the user's active sessions can be reviewed and terminated from their Security settings (requires admin access via SCIM or direct admin).

Force a device enrollment check

If the infected device is corporate-managed, trigger a remote wipe or at minimum a compliance check through your MDM (Intune, Jamf). The stealer malware may still be active on the device — a password reset from the infected device re-exposes the new credentials to the same malware. Ensure the credential rotation happens from a clean device.

Subscribe to unlock Remediation & Mitigation steps

Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.

Step 3: Investigate the infected machine

The credential exposure is a symptom. The infostealer malware on the source device is the cause. Remediation without addressing the source device results in the new credentials being stolen by the same malware.

Isolate and forensically image the suspected source device

Isolate the device from the network via your EDR or MDM before initiating forensic capture. Do not allow the device to continue normal operation — re-infection or active exfiltration may still be occurring. Capture a forensic image before wiping.

Check EDR telemetry for infostealer indicators

Review your EDR's process creation and network connection logs for the affected device in the 30 days before the alert. Infostealer IOCs include: execution of files from Temp directories with random names, browser process data reads from credential database paths (Login Data, Cookies files), and outbound connections to file hosting services (Discord CDN, Telegram API endpoints, GitHub gists) used as C2 by commodity infostealers.

Wipe and re-image, do not attempt remediation in place

Infostealer malware families often include persistence mechanisms. Attempting to identify and remove malware from an infected device without reimaging leaves you uncertain about persistence. For a confirmed infostealer infection, wipe the device and restore from a pre-infection backup or reimage from a clean baseline.

Subscribe to unlock Remediation & Mitigation steps

Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.

Step 4: Scope the blast radius

One infected device may have captured credentials for more than one employee if it was a shared workstation, or the affected employee may have accessed multiple sensitive systems.

Identify all credentials the infected employee had access to

Review the employee's role and the systems they accessed from the infected device. Any system accessible via browser on that device had its credentials captured. This includes: corporate SSO, SaaS applications, cloud consoles, internal web applications, and any personal accounts accessed on a corporate device (personal email, banking, social media). Notify the employee to change credentials for personal accounts as well.

Check for lateral movement from the captured session

Review authentication logs for any logins from unusual IPs, unusual times, or unusual user agents for the affected user's accounts in the 30 days since the credential exposure date. Many stealer log compilations are published weeks to months after the initial infection — the attacker may have been using the credentials for an extended period. Treat unexplained access as a potential compromise.

Notify affected users to change all personal credentials

Infostealer malware does not distinguish between corporate and personal credentials. If an employee used their corporate device for personal banking, their personal email, or any other account, those credentials were also captured. Notify the employee to change all browser-saved passwords from a clean device — not from the potentially infected device.

Subscribe to unlock Remediation & Mitigation steps

Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.

The bottom line

Infostealer credential exposure is distinct from a breach database entry in one critical way: session cookies are valid right now. The response window is hours, not weeks. Organizations that treat an infostealer alert as a simple password reset exercise and close the ticket miss the active session hijacking risk and the infected source device that will re-expose any new credentials set on it. Treat every confirmed infostealer exposure as an active incident until session revocation is confirmed, the source device is isolated, and EDR telemetry has been reviewed.

Frequently asked questions

What is an infostealer and how does it differ from ransomware?

Infostealer malware is designed to silently extract and exfiltrate credential data — passwords, session cookies, autofill data, and cryptocurrency wallets — without disrupting system operation. The infection is designed to go undetected for as long as possible. Ransomware is designed for visibility — it wants the victim to know about the attack to pay ransom. Infostealers support the credential economy: stolen credentials are sold in bulk on underground markets and used for account takeover, corporate espionage, and ransomware initial access.

Does MFA protect against infostealer credential theft?

MFA prevents attackers from using stolen passwords alone to authenticate. It does not protect against session cookie theft — if a valid session cookie is captured after the user has already authenticated through MFA, the attacker can use that cookie without needing the password or MFA token. FIDO2/passkeys (device-bound credentials) are resistant to this attack because session cookies cannot be used across different devices with FIDO2 enforcement.

How does dark web monitoring detect infostealer exposures?

Dark web monitoring services (SpyCloud, Flare, ZeroFox, Hudson Rock) maintain access to underground marketplaces and forums where infostealer logs are published and sold. They monitor these sources for credentials matching your email domains and alert when matches are found. The quality of monitoring varies significantly by service — enterprise services with direct marketplace access detect exposures much faster than services that rely on public breach compilation databases.

Sources & references

GitGuardian 2026 State of Secrets Sprawl Report
SpyCloud Annual Identity Exposure Report 2025
16 Billion Credentials Leak: Dark Web Exposure Check Guide

Free resources

Free download

Critical CVE Reference Card 2025–2026

25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.

Free download

Ransomware Incident Response Playbook

Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.

Free newsletter

Get threat intel before your inbox does.

50,000+ security professionals read Decryption Digest for early warnings on zero-days, ransomware, and nation-state campaigns. Free, daily, no spam.

Unsubscribe anytime. We never sell your data.

Author

Eric BangCISSP

Founder & Cybersecurity Evangelist, Decryption Digest

Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals every morning.

View profile →LinkedIn

Back to all briefings

Subscribe for Updates

infostealer credentials stealer log response corporate credentials dark web Redline Vidar credential theft session cookie theft credential exposure response dark web monitoring infostealer malware 2026

Black Hat Giveaway

Win a $2,495 Black Hat pass.

Full-access to Black Hat USA 2026 in Las Vegas. Subscribe free to enter.

Your Employee's Credentials Appeared in an Infostealer Log: The Response Workflow

What infostealer logs contain

Step 1: Confirm scope of the exposure

Step 2: Revoke sessions — not just passwords

Step 3: Investigate the infected machine

Step 4: Scope the blast radius

The bottom line

Frequently asked questions

What is an infostealer and how does it differ from ransomware?

Does MFA protect against infostealer credential theft?

How does dark web monitoring detect infostealer exposures?

Sources & references

Critical CVE Reference Card 2025–2026

Ransomware Incident Response Playbook

Get threat intel before your inbox does.

Subscribe to enter the giveaway