Credential theft isn’t simply an inconvenience. It’s typically the primary transfer in a sequence response that ends in full-scale compromise.
Past the dreaded password reset course of, data stealers, as proven in a number of latest cyberattacks, can have much more consequential follow-on results.
For a lot of small and mid-sized organizations, a single stolen identification can result in days of downtime and expensive restoration.
These results are multiplied when positioned in a enterprise context, the place stolen credentials and impersonated digital identities can result in enterprise electronic mail compromise, ransomware, and extra, costing corporations important downtime and restoration.
An data stealer, or “infostealer,” is a sort of malware that silently collects delicate information from a sufferer’s system and transmits it to menace actors. This malware can steal private data resembling usernames and passwords, monetary particulars, browser historical past, and different information on a focused system.
This kind of malware is often compact and has restricted performance in comparison with different headline-stealing threats like ransomware. Creators of infostealers sometimes design them to execute shortly, steal information, and self-delete earlier than detection.
Infostealers are simply obtainable to any motivated menace actor, placing industrial-grade functionality into the arms of entry-level attackers. Entry to a stealer command and management (C2) server operated by the developer can value as little as $50 a month, based on earlier analysis from the Sophos X-Ops Counter Risk Unit.
What occurs to these credentials as soon as they’re stolen, although? As soon as credentials depart your community, they hardly ever keep unused.
Risk actors can use them in a wide range of methods, together with extortion, future ransomware deployment, enterprise electronic mail compromise (BEC), and different expensive cyber assaults.
Extortion
Similar to when menace actors steal information in a ransomware assault, they will extort infostealer victims into paying a ransom in alternate for not leaking these stolen credentials or private data on deep and darkish internet boards.
Within the case of the notorious Snowflake provide chain assault, financially motivated menace actors stole login credentials from lots of of companies and individually extorted them. Among the credentials had been stolen 4 years prior, with organizations utterly unaware of this menace.
If the extorted corporations didn’t pay up, the menace actors behind the assault threatened to leak the credentials or promote them to different menace actors. The ensuing extortion of affected corporations led to direct monetary losses and illicit achieve upwards of $2 million, based on the Cloud Safety Alliance.
For a lot of victims, these shakedowns land with out warning, typically years after an preliminary an infection.
Ransomware assaults
Usually, infostealers are solely the primary stage in an extended assault that ends with ransomware.
Stolen credentials from infostealers are packaged into “logs” and offered on darkish internet marketplaces or shared by way of messaging platforms like Telegram. Then, preliminary entry brokers buy these logs, validate the credentials, and resell that entry to ransomware operators.
With the legitimate credentials in hand, dangerous actors can bypass conventional defenses like phishing filters or vulnerability scans. If multi-factor authentication (MFA) isn’t enforced, the stolen cookies may even grant full entry. As soon as inside, ransomware associates transfer laterally, exfiltrate delicate information, and deploy encryption payloads — locking down methods and demanding cost.
This felony ecosystem — from infostealers to entry brokers to ransomware operators — features like a provide chain, with every participant specializing in a special stage of the assault. This makes it simpler, quicker, and extra worthwhile to compromise organizations. In actual fact, compromised credentials have been the second commonest root explanation for ransomware assaults, based on the 2025 Sophos State of Ransomware report.
Enterprise electronic mail compromise
Past ransomware, malicious actors typically exploit stolen credentials in follow-on scams like enterprise electronic mail compromise (BEC), no matter whether or not they have been the unique thieves.
BEC happens every time an adversary is efficiently in a position to impersonate a goal enterprise or an worker for that group, to trick targets into believing the emails they obtain are reputable.
In 2023, Sophos X-Ops’ Counter Risk Unit (CTU) noticed menace actors concentrating on motels with phishing campaigns designed to ship infostealers and compromise their methods. As soon as contaminated, the menace actors behind the assault harvested credentials for the motels’ Reserving.com property accounts.
With direct entry to those accounts, the menace actors used reputable Reserving.com messaging channels to contact visitors with upcoming reservations. They despatched convincing phishing messages associated to actual bookings, typically requesting fraudulent funds. As a result of the messages got here from trusted sources and referenced precise reservations, victims have been extra prone to adjust to them.
There was a booming secondary marketplace for these credentials, too. CTU researchers noticed a excessive demand on underground boards for Reserving.com property credentials, and different menace actors requested infostealer logs that embrace credentials for the admin[.]Reserving[.]com property administration portal, which, when logged into, allowed the actors to view any upcoming reservation for a visitor, leveraging that data in malicious emails.
shield your credentials with Sophos
Identification has grow to be the management airplane for contemporary cyberattacks. Cybercriminals are more and more deploying subtle assaults that leverage compromised identities to realize unauthorized entry to delicate information and methods. Ninety % of organizations skilled at the very least one identity-related breach inside the final yr, based on a 2024 Identification Outlined Safety Alliance (IDSA) examine.
Sophos Identification Risk Detection and Response (ITDR) is purpose-built to cease identity-based assaults in actual time. It constantly screens your setting for identification dangers and misconfigurations, whereas leveraging darkish internet intelligence to uncover compromised credentials — even earlier than they’re weaponized.
Organizations can strengthen defenses by taking a proactive stance. Preventative measures, resembling sustaining good safety hygiene and strengthening identification safety posture earlier than an assault happens, are equally vital as detection and response efforts, which contain monitoring for assaults and stopping them as soon as they’re underway.
However to make sure your credentials and delicate information are protected, Sophos ITDR can warn you to any potential stolen or leaked credentials earlier than a menace actor is ready to flow into them on-line to others or use them in any follow-on assaults.
With infostealers fueling a rising underground economic system of stolen entry, organizations must act earlier than credentials are weaponized. Sophos ITDR empowers you to take management, detect threats early, and reply with confidence. Don’t look forward to the following suspicious login or inbox shock. Take a proactive step towards stronger identification safety — begin your free Sophos ITDR trial at the moment.
