Protecting Business From The Infostealer Threat

Infostealers were responsible for the theft of over 3.9 billion credentials last year. As businesses become increasingly reliant on digital infrastructure, attackers are refining their techniques to harvest sensitive login data, bypass security measures, and exploit stolen information for financial gain. 

The latest data from KELA's State of Cybercrime 2024 report estimated that at least 4.3 million machines were infected by infostealer malware last year, resulting in over 330 million compromised credentials.

With cybercriminals also sharing vast repositories of stolen credentials, such as ULP files that contain billions of compromised login details, the risks have never been greater.

For businesses, protecting credentials is pivotal. If an attacker gains access to an employee’s login details, they could infiltrate internal systems, move laterally within the network, and launch devastating attacks, from data theft to ransomware. To mitigate these risks, organisations must adopt a multi-layered security approach, including strong authentication, robust credential management, and endpoint security.

Multifactor Authentication Is The First Line Of Defence

Passwords are no longer enough to secure business accounts. Cybercriminals can easily steal or brute-force weak credentials, and with the rise of infostealer malware, even complex passwords stored in browsers are at risk.

Multi-factor authentication (MFA) is one of the most effective ways to protect against compromised credentials. By requiring an additional verification step, like a one-time passcode (OTP) or biometric authentication, MFA ensures that even if a password is stolen, attackers cannot gain access to an account.

Hardware-backed authentication methods, like FIDO2 security keys or passkeys, provide an even stronger layer of security. These methods rely on cryptographic key pairs stored securely on a physical device, meaning attackers cannot authenticate without access to the hardware. Businesses should prioritise the adoption of FIDO-based authentication to reduce the risks associated with credential theft.

Robust Credential Management Prevents Exposure & Misuse

While MFA is crucial, businesses must also address the way credentials are stored and managed. Many infostealer breaches occur because employees store passwords insecurely, either in plain text, browser password managers, or easily accessible files.

Using a dedicated password manager is essential for secure storage and automatic password rotation. Enterprise-grade password management solutions can generate complex, unique passwords for each account and ensure they are never exposed in unprotected environments. On top of this, businesses should enforce the use of passphrases rather than traditional passwords, as longer credentials are significantly harder to crack.

Beyond password storage, elevation approvals for privileged access can serve as an additional safeguard. If an attacker successfully compromises a credential, access control measures can prevent them from escalating privileges without further authorisation. Implementing just-in-time access and regular audits of privileged accounts will help ensure that only authorised users can perform sensitive actions.

Strengthening Endpoint Security

Infostealer malware usually infiltrates devices through phishing attacks, malicious downloads, or compromised websites. Once installed, the malware extracts saved credentials, browser cookies, session tokens, and autofill data, often exfiltrating the information to cybercriminals within minutes.

To mitigate these risks, businesses should invest in advanced Endpoint Detection and Response (EDR) solutions that can identify and neutralise infostealer infections before they cause serious harm.

Traditional antivirus software is often ineffective against modern, sophisticated infostealers, making AI-driven threat detection a necessity. Network segmentation can also limit an attacker’s ability to move laterally if a device is compromised, reducing the overall risk to an organisation.

The Rise Of Session Hijacking

Infostealer malware is evolving beyond just password theft. Cybercriminals are targeting active session tokens, allowing them to bypass authentication entirely. Once they obtain a valid session cookie, attackers can hijack an account without needing a password or MFA approval.

Businesses must adapt their security strategies to counteract session hijacking. One approach is to reduce session persistence by enforcing frequent re-authentication, particularly for high-risk accounts. Implementing device-bound session cookies can also help, ensuring that authentication tokens cannot be used outside of the original, trusted device.

Zero-trust security principles play a crucial role in this battle. By continuously verifying user identities, monitoring for unusual activity, and applying adaptive access controls, organisations can prevent attackers from exploiting compromised credentials and session tokens.

Building A Resilient Security Culture

Technology alone is not enough as human behaviour remains a critical factor in credential security. Employees must be trained to recognise phishing attempts, avoid downloading unverified software, and report suspicious activity immediately. Security awareness training should be an ongoing initiative rather than a one-time exercise.
Regular red teaming exercises and penetration testing can also help businesses identify vulnerabilities in their authentication processes and credential management practices. By simulating real-world attack scenarios, organisations can proactively address security gaps before cybercriminals exploit them.

Infostealers are an ever-growing threat, with cybercriminals finding new ways to harvest credentials and infiltrate corporate networks. However, businesses are not powerless. A comprehensive security approach, like MFA, hardware-backed authentication, password management, endpoint security, and continuous monitoring, can significantly reduce the risk of credential compromise.

As attackers evolve, so must our defences. By prioritising proactive security measures and fostering a culture of vigilance, organisations can stay ahead of infostealers and safeguard their most valuable digital assets.

Joel Rennich is SVP of Product Management at JumpCloud

Image: 

You Might Also Read: 

Hackers Exploiting Malware In Google Docs:


If you like this website and use the comprehensive 7,000-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« Geopolitics, Nation-State Hackers & Cyberwar
Exploring The Growing Popularity Of Data Security Posture Management »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Resecurity

Resecurity

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

ZenGRC

ZenGRC

ZenGRC (formerly Reciprocity) is a leader in the GRC SaaS landscape, offering robust and intuitive products designed to make compliance straightforward and efficient.

Maureen Data Systems (MDS)

Maureen Data Systems (MDS)

Our mission at Maureen Data Systems is to digitally transform business environments with the use of cloud infrastructure, security and privacy controls, data analytics, and managed services.

CERT-In

CERT-In

CERT-In is a functional organisation of the Ministry of Information & Electronics Technology, Government of India, with the objective of securing Indian cyber space.

GrammaTech

GrammaTech

GrammaTech is a leading developer of software-assurance tools and advanced cyber-security solutions.

Claroty

Claroty

Claroty was conceived to secure and optimize OT networks that run the world’s most critical infrastructures.

IOTA Foundation

IOTA Foundation

The IOTA Foundation is a non-profit R&D organisation focused on developing the next generation of protocols for the connected world.

Zeguro

Zeguro

Zeguro provides complete cybersecurity risk assessment, mitigation and insurance, allowing you to easily manage your cyber risk.

CloudOak

CloudOak

CloudOak is a cloud channel provider for hybrid cloud Backup as a Service (BaaS), Disaster Recovery as a Service (DRaaS) and Archiving to Small to Medium Business (SMB).

Y-PARC

Y-PARC

Y-PARC is a center of excellence for cybersecurity, precision industries and medtech, fostering innovation and development and support for startups.

Get Indemnity

Get Indemnity

Get Indemnity are specialist insurance brokers with experience working on a wide range of innovative business insurance products that combine risk management, indemnity and incident response services.

Citalid

Citalid

The Citalid cyber risk management platform combines threat and business intelligence to identify the risks scenarios you face.

Raxis

Raxis

Raxis is a cybersecurity company that hacks into computer networks and physical structures to perform penetration tests, assessing corporate vulnerability to real-world threats.

CipherStash

CipherStash

CipherStash is a complete data governance and breach prevention platform.

Gutsy

Gutsy

Gutsy uses process mining to help organizations visualize and analyze their complex security processes to understand how they actually run, based on observable event data.

Kontra

Kontra

Kontra application security training is an interactive and intuitive learning experience that engages developers.

Ampsight

Ampsight

Ampsight specializes in enabling cloud integration, securing data, and navigating complications that drive critical-mission success.

Vonahi Security

Vonahi Security

Vonahi Security is a cybersecurity SaaS company that pioneered automated network penetration testing.