Protecting Business From The Infostealer Threat

Infostealers were responsible for the theft of over 3.9 billion credentials last year. As businesses become increasingly reliant on digital infrastructure, attackers are refining their techniques to harvest sensitive login data, bypass security measures, and exploit stolen information for financial gain. 

The latest data from KELA's State of Cybercrime 2024 report estimated that at least 4.3 million machines were infected by infostealer malware last year, resulting in over 330 million compromised credentials.

With cybercriminals also sharing vast repositories of stolen credentials, such as ULP files that contain billions of compromised login details, the risks have never been greater.

For businesses, protecting credentials is pivotal. If an attacker gains access to an employee’s login details, they could infiltrate internal systems, move laterally within the network, and launch devastating attacks, from data theft to ransomware. To mitigate these risks, organisations must adopt a multi-layered security approach, including strong authentication, robust credential management, and endpoint security.

Multifactor Authentication Is The First Line Of Defence

Passwords are no longer enough to secure business accounts. Cybercriminals can easily steal or brute-force weak credentials, and with the rise of infostealer malware, even complex passwords stored in browsers are at risk.

Multi-factor authentication (MFA) is one of the most effective ways to protect against compromised credentials. By requiring an additional verification step, like a one-time passcode (OTP) or biometric authentication, MFA ensures that even if a password is stolen, attackers cannot gain access to an account.

Hardware-backed authentication methods, like FIDO2 security keys or passkeys, provide an even stronger layer of security. These methods rely on cryptographic key pairs stored securely on a physical device, meaning attackers cannot authenticate without access to the hardware. Businesses should prioritise the adoption of FIDO-based authentication to reduce the risks associated with credential theft.

Robust Credential Management Prevents Exposure & Misuse

While MFA is crucial, businesses must also address the way credentials are stored and managed. Many infostealer breaches occur because employees store passwords insecurely, either in plain text, browser password managers, or easily accessible files.

Using a dedicated password manager is essential for secure storage and automatic password rotation. Enterprise-grade password management solutions can generate complex, unique passwords for each account and ensure they are never exposed in unprotected environments. On top of this, businesses should enforce the use of passphrases rather than traditional passwords, as longer credentials are significantly harder to crack.

Beyond password storage, elevation approvals for privileged access can serve as an additional safeguard. If an attacker successfully compromises a credential, access control measures can prevent them from escalating privileges without further authorisation. Implementing just-in-time access and regular audits of privileged accounts will help ensure that only authorised users can perform sensitive actions.

Strengthening Endpoint Security

Infostealer malware usually infiltrates devices through phishing attacks, malicious downloads, or compromised websites. Once installed, the malware extracts saved credentials, browser cookies, session tokens, and autofill data, often exfiltrating the information to cybercriminals within minutes.

To mitigate these risks, businesses should invest in advanced Endpoint Detection and Response (EDR) solutions that can identify and neutralise infostealer infections before they cause serious harm.

Traditional antivirus software is often ineffective against modern, sophisticated infostealers, making AI-driven threat detection a necessity. Network segmentation can also limit an attacker’s ability to move laterally if a device is compromised, reducing the overall risk to an organisation.

The Rise Of Session Hijacking

Infostealer malware is evolving beyond just password theft. Cybercriminals are targeting active session tokens, allowing them to bypass authentication entirely. Once they obtain a valid session cookie, attackers can hijack an account without needing a password or MFA approval.

Businesses must adapt their security strategies to counteract session hijacking. One approach is to reduce session persistence by enforcing frequent re-authentication, particularly for high-risk accounts. Implementing device-bound session cookies can also help, ensuring that authentication tokens cannot be used outside of the original, trusted device.

Zero-trust security principles play a crucial role in this battle. By continuously verifying user identities, monitoring for unusual activity, and applying adaptive access controls, organisations can prevent attackers from exploiting compromised credentials and session tokens.

Building A Resilient Security Culture

Technology alone is not enough as human behaviour remains a critical factor in credential security. Employees must be trained to recognise phishing attempts, avoid downloading unverified software, and report suspicious activity immediately. Security awareness training should be an ongoing initiative rather than a one-time exercise.
Regular red teaming exercises and penetration testing can also help businesses identify vulnerabilities in their authentication processes and credential management practices. By simulating real-world attack scenarios, organisations can proactively address security gaps before cybercriminals exploit them.

Infostealers are an ever-growing threat, with cybercriminals finding new ways to harvest credentials and infiltrate corporate networks. However, businesses are not powerless. A comprehensive security approach, like MFA, hardware-backed authentication, password management, endpoint security, and continuous monitoring, can significantly reduce the risk of credential compromise.

As attackers evolve, so must our defences. By prioritising proactive security measures and fostering a culture of vigilance, organisations can stay ahead of infostealers and safeguard their most valuable digital assets.

Joel Rennich is SVP of Product Management at JumpCloud

Image: 

You Might Also Read: 

Hackers Exploiting Malware In Google Docs:


If you like this website and use the comprehensive 7,000-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« Geopolitics, Nation-State Hackers & Cyberwar
Exploring The Growing Popularity Of Data Security Posture Management »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Directory of Cyber Security Suppliers

Directory of Cyber Security Suppliers

Our Supplier Directory lists 7,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Resecurity

Resecurity

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

Arsenal Insurance Company

Arsenal Insurance Company

Arsenal is an insurance provider based in Moscow, Russia. Services offered include Cyber Risk insurance.

Cloudbric

Cloudbric

Cloudbric is a cloud-based web security service, offering award-winning WAF, DDoS protection, and SSL, all in a full-service package.

Saviynt

Saviynt

Saviynt is a leading provider of Cloud Security and Identity Governance solutions.

RazorSecure

RazorSecure

RazorSecure offers products and services to enhance railway cyber security, by protecting and monitoring networks and key systems.

Hellenic Accreditation System (ESYD)

Hellenic Accreditation System (ESYD)

ESYD is the national accreditation body for Greece. The directory of members provides details of organisations offering certification services for ISO 27001.

Cybersecurity Professionals

Cybersecurity Professionals

Search vacancies from top cyber security jobs worldwide on CyberSecurity Professionals. View IT security jobs or upload your CV to be seen by recruiters from industry leading firms.

Gigacycle

Gigacycle

Gigacycle is one of the leading IT disposal and recycling providers in the UK. We specialise in IT asset disposal (ITAD) and data destruction.

Trust Stamp

Trust Stamp

Trust Stamp provide Identity and Trust as a Service to answer two fundamental questions: “Who are you?” and “Do I trust you?"

Macquarie Telecom Group

Macquarie Telecom Group

Macquarie Telecom is Australia's datacentre, cloud, cyber security and telecom company for mid-large business and government customers.

Newtec Services

Newtec Services

IT should be responsive, adaptive, and smart. Now more than ever, you need a business that runs efficiently and can adapt to today's challenges. We can help with custom IT solutions.

Neptune Cyber

Neptune Cyber

Neptune is a cyber security company that works exclusively in the marine sector. Our team combines experts in shipbuilding, maintenance and operations and cyber security testing and design.

Chugach Government Solutions (CGS)

Chugach Government Solutions (CGS)

CGS performs work for the Federal Government across 4 unique core lines of business, including: Facilities Management and Maintenance, Construction, Technical IT and Cyber Services, and Educational Se

TrustCloud

TrustCloud

TrustCloud is a global company specializing in the orchestration and custody of secure digital transactions including identification, signature, payments, and electronic custody.

CyberNut

CyberNut

CyberNut are a security awareness training solution built exclusively for schools.

Ryan Financial Lines

Ryan Financial Lines

Ryan Financial Lines Cyber provides risk transfer solutions for complex cyber and technology exposures, globally.

Sphinx

Sphinx

Sphinx provide advanced security consulting services and cyber solutions to federal and private industry.