Protecting Business From The Infostealer Threat

Infostealers were responsible for the theft of over 3.9 billion credentials last year. As businesses become increasingly reliant on digital infrastructure, attackers are refining their techniques to harvest sensitive login data, bypass security measures, and exploit stolen information for financial gain. 

The latest data from KELA's State of Cybercrime 2024 report estimated that at least 4.3 million machines were infected by infostealer malware last year, resulting in over 330 million compromised credentials.

With cybercriminals also sharing vast repositories of stolen credentials, such as ULP files that contain billions of compromised login details, the risks have never been greater.

For businesses, protecting credentials is pivotal. If an attacker gains access to an employee’s login details, they could infiltrate internal systems, move laterally within the network, and launch devastating attacks, from data theft to ransomware. To mitigate these risks, organisations must adopt a multi-layered security approach, including strong authentication, robust credential management, and endpoint security.

Multifactor Authentication Is The First Line Of Defence

Passwords are no longer enough to secure business accounts. Cybercriminals can easily steal or brute-force weak credentials, and with the rise of infostealer malware, even complex passwords stored in browsers are at risk.

Multi-factor authentication (MFA) is one of the most effective ways to protect against compromised credentials. By requiring an additional verification step, like a one-time passcode (OTP) or biometric authentication, MFA ensures that even if a password is stolen, attackers cannot gain access to an account.

Hardware-backed authentication methods, like FIDO2 security keys or passkeys, provide an even stronger layer of security. These methods rely on cryptographic key pairs stored securely on a physical device, meaning attackers cannot authenticate without access to the hardware. Businesses should prioritise the adoption of FIDO-based authentication to reduce the risks associated with credential theft.

Robust Credential Management Prevents Exposure & Misuse

While MFA is crucial, businesses must also address the way credentials are stored and managed. Many infostealer breaches occur because employees store passwords insecurely, either in plain text, browser password managers, or easily accessible files.

Using a dedicated password manager is essential for secure storage and automatic password rotation. Enterprise-grade password management solutions can generate complex, unique passwords for each account and ensure they are never exposed in unprotected environments. On top of this, businesses should enforce the use of passphrases rather than traditional passwords, as longer credentials are significantly harder to crack.

Beyond password storage, elevation approvals for privileged access can serve as an additional safeguard. If an attacker successfully compromises a credential, access control measures can prevent them from escalating privileges without further authorisation. Implementing just-in-time access and regular audits of privileged accounts will help ensure that only authorised users can perform sensitive actions.

Strengthening Endpoint Security

Infostealer malware usually infiltrates devices through phishing attacks, malicious downloads, or compromised websites. Once installed, the malware extracts saved credentials, browser cookies, session tokens, and autofill data, often exfiltrating the information to cybercriminals within minutes.

To mitigate these risks, businesses should invest in advanced Endpoint Detection and Response (EDR) solutions that can identify and neutralise infostealer infections before they cause serious harm.

Traditional antivirus software is often ineffective against modern, sophisticated infostealers, making AI-driven threat detection a necessity. Network segmentation can also limit an attacker’s ability to move laterally if a device is compromised, reducing the overall risk to an organisation.

The Rise Of Session Hijacking

Infostealer malware is evolving beyond just password theft. Cybercriminals are targeting active session tokens, allowing them to bypass authentication entirely. Once they obtain a valid session cookie, attackers can hijack an account without needing a password or MFA approval.

Businesses must adapt their security strategies to counteract session hijacking. One approach is to reduce session persistence by enforcing frequent re-authentication, particularly for high-risk accounts. Implementing device-bound session cookies can also help, ensuring that authentication tokens cannot be used outside of the original, trusted device.

Zero-trust security principles play a crucial role in this battle. By continuously verifying user identities, monitoring for unusual activity, and applying adaptive access controls, organisations can prevent attackers from exploiting compromised credentials and session tokens.

Building A Resilient Security Culture

Technology alone is not enough as human behaviour remains a critical factor in credential security. Employees must be trained to recognise phishing attempts, avoid downloading unverified software, and report suspicious activity immediately. Security awareness training should be an ongoing initiative rather than a one-time exercise.
Regular red teaming exercises and penetration testing can also help businesses identify vulnerabilities in their authentication processes and credential management practices. By simulating real-world attack scenarios, organisations can proactively address security gaps before cybercriminals exploit them.

Infostealers are an ever-growing threat, with cybercriminals finding new ways to harvest credentials and infiltrate corporate networks. However, businesses are not powerless. A comprehensive security approach, like MFA, hardware-backed authentication, password management, endpoint security, and continuous monitoring, can significantly reduce the risk of credential compromise.

As attackers evolve, so must our defences. By prioritising proactive security measures and fostering a culture of vigilance, organisations can stay ahead of infostealers and safeguard their most valuable digital assets.

Joel Rennich is SVP of Product Management at JumpCloud

Image: 

You Might Also Read: 

Hackers Exploiting Malware In Google Docs:


If you like this website and use the comprehensive 7,000-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« Geopolitics, Nation-State Hackers & Cyberwar
Exploring The Growing Popularity Of Data Security Posture Management »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

ZenGRC

ZenGRC

ZenGRC (formerly Reciprocity) is a leader in the GRC SaaS landscape, offering robust and intuitive products designed to make compliance straightforward and efficient.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

TÜV SÜD Academy UK

TÜV SÜD Academy UK

TÜV SÜD offers expert-led cybersecurity training to help organisations safeguard their operations and data.

NCC Group

NCC Group

NCC Group is a global cyber and software resilience business operating across multiple sectors, geographies and technologies.

Security Brigade

Security Brigade

Security Brigade is an information security firm specializing in Penetration Testing, Vulnerability Assessment, Web-application Security and Source Code Security Audit.

Invensis Learning

Invensis Learning

Invensis Learning is a professional training and certification company providing IT Service Management, IT Security & Governance, DevOps, Cloud Computing and Digital Awareness training.

CARICERT

CARICERT

CARICERT is the National Cyber Emergency Response Team of Curacao in the Caribbean.

ThreatAware

ThreatAware

Total visibility of your business cybersecurity. Monitoring, management and compliance for your cybersecurity tools, people and processes from one easy to use dashboard.

CYE

CYE

Utilizing data, numbers, and facts, CYE helps security leaders know what business assets are at risk and execute cost-effective remediation projects for optimal risk prevention.

C2A Security

C2A Security

C2A Security offers a comprehensive suite of cyber security solutions for the automotive industry, providing in-vehicle end-to-end protection.

RCMP National Cybercrime Coordination Unit (NC3)

RCMP National Cybercrime Coordination Unit (NC3)

As set out in the Government of Canada's National Cyber Security Strategy, the RCMP has established the National Cybercrime Coordination Unit (NC3).

Qasky

Qasky

Anhui Qasky Quantum Technology Co. Ltd. (Qasky) is a new high-tech enterprise engaged in quantum information technology industrialization in China.

IPKeys Technologies

IPKeys Technologies

IPKeys delivers innovative cybersecurity and technology solutions focused on helping the federal government reduce risk and protect the US from cyberattacks.

Symbol Security

Symbol Security

Through situational learning, simulations, and a gamified user experience, Symbol strengthens the cyber awareness of employees and helps companies lower cyber risk.

Identity Digital

Identity Digital

Identity Digital simplifies and connects a fragmented online world with domain names and related technologies that allow people and businesses to build, market and own their digital identities.

Cenobe Cyber Security

Cenobe Cyber Security

Cenobe provides customized solutions to keep you ahead of potential threats and ensure the security of your organization's systems and data.

Security Discovery

Security Discovery

Stay ahead of cyber threats with Security Discovery. We offer expert consulting, comprehensive services, and a powerful vulnerability monitoring SaaS platform.

BTQ Technologies

BTQ Technologies

BTQ is a global quantum technology company focused on securing mission critical networks.

Xantaro

Xantaro

Xantaro specializes in technologies, software and services for Carriers, ISPs, Hosting and Cloud Providers as well as for Operators of Data Centres and Campus Networks.