Stop counting stolen passwords: Here’s what really brings organizations to their knees
There is something way more dangerous than a leaked password.
Image by Cybernews.
Follow us
- Outpost24 found infostealer logs linked to 72% of 4,824 organizations in the US and Europe.
- Infostealer malware can steal session cookies, letting attackers access accounts even after passwords change.
- Less than 3% of exposed credentials came from infostealer logs, but they affected nearly three-quarters of organizations.
- Outpost24 says security teams should investigate infected devices and revoke active sessions, not just reset passwords.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
Recent attacks on Meta’s GitHub repositories, which involved stolen employee credentials, highlight a broader problem: cybercriminals are increasingly getting into corporate systems without having to crack passwords at all.
A new report by cybersecurity company Outpost24 found that 72% of 4,824 organizations in the US and Europe had employee or customer credentials identified in infostealer malware logs over a 12-month period.
Why infostealer malware is such a threat
Infostealer malware can collect saved logins and session cookies from infected devices, potentially allowing attackers to take over accounts even after passwords have been changed.
Unlike old passwords circulating in leaked databases, credentials collected from infected devices can expose much more, including saved login information and active sessions.
The malware can also steal session cookies, which allow websites to recognize users who have already logged in. If attackers obtain these cookies, they may be able to access accounts without entering a password.
Nearly 31 million identified credentials came from so-called breach dumps and combolists – collections of stolen login credentials circulated on the dark web by cybercriminals. The remaining 844,000 were taken directly from infected devices using infostealer malware.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
Outpost24 found that 41% of organizations had at least one credential stolen by an infostealer associated with a staff email address. It potentially indicates that a work device had been infected.
"Less than 3% of exposed credentials came directly from infostealer logs, yet nearly three-quarters of organizations were affected. That tells us why counting stolen passwords isn't enough," said Borja Rodriguez, Head of Threat Intelligence at Outpost24.
“An infostealer doesn’t stop at one password. It can take session cookies, saved credentials, and access to multiple accounts. Resetting a password may close one door while leaving others wide open. Security teams need to investigate the infection, not just the exposed credential.”
Outpost24 recommends investigating potentially infected employee devices and checking for any additional information that may have been stolen. Revoking all active sessions is also crucial.