Infostealers Are Now the Front Door for Ransomware Gangs
Credential theft at industrial scale has made exploit-based initial access look quaint. Here's why stolen session tokens are reshaping the attack chain.
Forget the phishing kit. Forget the unpatched VPN appliance. The cleanest path into an enterprise network right now is a valid username and password — ideally with a fresh session cookie attached — exfiltrated by malware the victim never knew was running.
Infostealers have matured into a cottage industry. Commodity families like RedLine, Raccoon, and Lumma Stealer sweep browsers for saved credentials, autofill data, and stored session tokens, then ship the harvest to a command-and-control server within minutes of infection. That harvest lands on criminal marketplaces, often priced by the log, often within hours.
The downstream buyers aren't subtle about what they want. Ransomware affiliates, business email compromise crews, and initial-access brokers all shop these markets for one thing: proof of authentication, not the act of authenticating. A stolen OAuth access token or a SAML assertion ripped from browser storage already passed MFA. The identity provider saw a legitimate login. Nothing looks wrong because, at the protocol level, nothing is wrong.
That last point deserves emphasis. MFA stops password stuffing cold. It does almost nothing against an infostealer that grabs the post-authentication artifact — the session cookie, the refresh token (RFC 6749, §6), the OIDC ID token sitting in localStorage. The attacker doesn't replay your credentials. They replay your proof that you already authenticated.
The scale is staggering. Tens of millions of devices run infostealer infections at any given moment, and the credential logs they generate feed a market that treats corporate SSO access as a line item. A Fortune 500 VPN login with an active session can fetch more than a hundred dollars. A cloud console token with broad IAM permissions fetches considerably more.
Defenders have a few realistic levers. Short-lived access tokens and aggressive refresh-token rotation (mandated under OAuth 2.0 best practices in RFC 9700) limit the window an attacker has to use a stolen credential. Binding session tokens to device posture — continuous access evaluation, conditional access policies — forces re-authentication when context shifts. Endpoint detection that flags the specific file-system paths browsers use to store credential databases is noisy but catches the exfiltration act rather than the downstream abuse.
Passkeys (FIDO2/WebAuthn) close the loop more elegantly: the authenticator never hands a reusable secret to the browser, so there's nothing for an infostealer to grab. Adoption is accelerating, but the installed base of password-plus-cookie authentication is enormous and will outlive the next several news cycles.
Until it doesn't, stolen credentials remain the ransomware ecosystem's cheapest, most reliable supply chain.
