When an Employee's Password Shows Up in a Stealer Log, the Session Cookie Is the Real Problem
Infostealer malware grabs more than passwords. It grabs live logins, and that's what lets attackers walk past multi-factor prompts.
Key points
- Infostealer malware, small programs that quietly copy data off an infected computer, takes saved passwords, browser session cookies, and autofill data in one sweep.
- Stolen session cookies can let attackers sign in as an employee without typing a password or triggering a multi-factor prompt.
- Security teams find these leaks in criminal marketplaces and Telegram channels, often weeks after the infection.
- Rotating the password alone isn't enough. Active browser sessions have to be killed too.
- Flare, the threat intelligence firm behind the guidance, says the priority question is whether the stolen access still works right now.
A password turning up in a stealer log isn't the story. The story is what sits next to it in that log.
Infostealers are small programs that run on an employee's laptop, usually after someone downloads a cracked app or clicks a poisoned ad, and copy everything the browser has cached. Saved logins. Autofill. Crypto wallet files. And the session cookies, which are the little tokens your browser holds after you sign in so you don't have to authenticate again on every click.
Those cookies are the crown jewels. If an attacker replays a valid cookie, the target service treats them as the already-signed-in user. No password prompt, no push notification to approve. Multi-factor authentication, the second check where you tap a phone or type a code, never fires, because from the app's point of view the login already happened. We've tracked this pattern across 28 session-hijacking stories since 4 June, including Anthropic's warning on 30 August that active Claude sessions were being lifted and reused without a password.
BleepingComputer flagged new guidance from Flare walking defenders through what to do when an employee's credentials surface in one of these dumps. The short version: assume the session is live until you prove it's dead.
How did the password end up in a log in the first place?
Usually a personal device, not a corporate one. An employee installed something dodgy at home, or clicked a fake CAPTCHA that ran a PowerShell command, and malware such as RedLine or Lumma scraped the browser. The operator then sells the log on a marketplace or dumps it into a Telegram channel.
A typical log includes the URL, the username, the password, the cookies for every site the user was signed into, and a machine fingerprint. That's enough to impersonate the person on Okta, Salesforce, GitHub, whatever they had open. The corporate SSO login is often the most valuable single line in the file.
What should a security team actually do when they find one?
Answer the live-access question first, then clean up. Flare's playbook lines up with what most incident responders already do, but it's worth stating plainly because the failure mode here is treating it like a normal password reset ticket.
| Step | What it means in plain English |
|---|---|
| Confirm the identity | Match the leaked email to a real employee and the systems they can reach. |
| Check if the session is still valid | Try the cookie in a sandbox, or check identity provider logs for recent sign-ins from odd locations. |
| Kill active sessions | Force sign-out everywhere in Entra ID, Okta or Google Workspace, not just a password reset. |
| Reset and re-enrol MFA | New password, new MFA factors, because the old seed may also be in the log. |
| Hunt for follow-on activity | Look for mailbox rules, OAuth app grants, and new device registrations in the last 30 days. |
The step people skip is the third one. Rotating a password doesn't invalidate an existing cookie on most SaaS platforms. The attacker keeps their session while the employee sets a new password and thinks the problem's solved.
Should ordinary staff worry about this?
Yes, and there's one habit that helps more than any tool. Don't sign into work accounts from a personal machine you also use to install random software or play pirated games. That's where these infections happen. If your employer offers a managed laptop, use it for work and keep the two worlds apart.
If your company tells you credentials appeared in a stealer log, take the reset seriously. Sign out of everything on every device, not just change the password on one.
One thing the post-mortem will say: the cookie was still valid for eleven days.
