The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Infostealers are an important supply route for identity-enabled attacks: they can harvest passwords, browser cookies, session tokens and personal data, then place that material in criminal resale channels. Another actor may use a valid credential or token to enter a cloud account, add a new authentication method, search files and mail, or reach financial and business systems. That pathway helps explain the increase in identity-focused intrusions, but available provider reports do not establish a single global percentage of identity attacks caused by infostealers.
What “identity-enabled” means
An identity-enabled attack starts with a trusted account or authentication artifact rather than an obvious exploit against a server. The attacker signs in as a legitimate user, or presents a stolen session token that a service accepts, and then abuses the permissions attached to that identity.
For a consumer, the target might be an email, banking, brokerage, payment or cryptocurrency account. In an organization, the same technique can open cloud applications, shared files, email and administrative functions. Unit 42’s 2026 Global Incident Response Report says attackers increasingly “log in” with stolen credentials and tokens, exploiting fragmented identity estates to escalate privileges and move laterally. That is a description of Unit 42’s engagements, not a census of every breach.
How infostealers lead to account takeovers
- A device is infected. The malware may arrive through a malicious download, a fake update, a cracked application, a phishing lure or another delivery method.
- The infostealer inventories the device. Microsoft, CISA and SpyCloud describe theft that can include saved credentials, personal information, browser cookies or other session data, system details and, in some cases, cryptocurrency-wallet information.
- The malware sends a “log.” A log can contain the stolen values plus information about the device and software. It may be bundled with data from many other victims.
- Criminals distribute or resell the data. Microsoft reports that Lumma data was sold to access brokers. Those brokers can offer a foothold to a different criminal group instead of carrying out the intrusion themselves.
- An operator tests the identity material. The buyer may try the password, replay a browser session or use the information to target a higher-value account.
- Access expands. Once inside, an attacker can add an authentication method, obtain additional tokens, enumerate cloud resources, read mail or download organizational data. This sequence is a practical model of the pathway; no single report proves that every incident followed all of these steps or began with an infostealer.
Passwords and session tokens are different kinds of stolen access
| Stolen material | What it represents | Why it matters | Typical response |
|---|---|---|---|
| Username and password | A reusable secret for signing in | It can be tried against the original service and against other services where the password was reused. | Change the password, invalidate existing sessions where possible, and enable stronger MFA. |
| Browser cookie or session token | Proof that a browser has already authenticated | In some services, replaying it can provide access without entering the password again and may avoid a fresh MFA prompt. | Revoke sessions and tokens, sign out all devices, investigate activity and remove unauthorized authentication methods. |
| Personal and system information | Context about the person, device and accounts | It can support phishing, impersonation, account recovery abuse and further targeting. | Review account-recovery details, watch for social engineering and investigate related accounts. |
A stolen password and a stolen session are therefore not interchangeable. Password rotation can stop reuse of the password, but it may not terminate a session that was already issued. Conversely, a session token can expire or be invalidated by the service, and controls such as conditional access or token binding may prevent replay. Whether a cookie works depends on the service, token type, device signals and the attacker’s access to the token.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Can stolen browser cookies bypass MFA?
Sometimes, yes. MFA normally protects the act of creating a session. If an attacker steals a valid session cookie after that step, the service may treat the browser as already authenticated until the session expires or is revoked. That is why a security key is not a guarantee against every consequence of malware: it can protect a new sign-in while a previously issued token remains usable.
Cookie theft does not make every account immediately vulnerable. Modern services can require a new authentication step for sensitive actions, bind sessions to a device, detect impossible travel or terminate sessions after risk signals. Those controls reduce the window but do not eliminate the need to investigate and revoke sessions after suspected theft.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What the latest figures show—and what they do not
The numbers below come from different organizations, observation windows and datasets. They indicate the scale of exposure seen by those providers; they are not interchangeable measures or a global causal rate.
| Source and scope | Reported finding | Correct interpretation |
|---|---|---|
| Microsoft, Digital Defense Report 2025; observations from October 2024 through October 2025 | Lumma Stealer was the most prevalent infostealer Microsoft observed in that period. | This is Microsoft’s telemetry, not a count of all infections worldwide. Microsoft also said a mid-2025 operation with the U.S. Department of Justice, Europol and Japan’s Cybercrime Control Center seized or blocked more than 2,300 malicious domains; that action did not end the broader infostealer threat. |
| Palo Alto Networks Unit 42, 2026 Global Incident Response Report; more than 750 major incidents handled in 2025 | Identity weaknesses played a material role in almost 90% of its investigations; 87% of intrusions involved multiple attack surfaces and 48% involved browser-based activity. | These percentages describe Unit 42’s response engagements, not all global breaches and not the percentage specifically caused by infostealers. |
| SpyCloud, 2025 Identity Exposure Report; analysis of data it recaptured in 2024 | More than 18 million unique malware-infection logs, 548 million malware-exfiltrated credentials, an average of 44 exposed credentials per infection, and 17 billion cookies siphoned by malware. | SpyCloud’s dataset is not a census of people, valid sessions or successful takeovers. “Cookies” does not mean 17 billion unique users or 17 billion active accounts. |
No common denominator in these reports establishes how many identity attacks globally were caused by infostealers. The defensible conclusion is narrower: infostealers are a significant source of credentials and session material that other criminals can use in identity-based intrusions.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallRank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How the downstream cloud intrusion can unfold
Microsoft Security Research’s September 9, 2026 incident report describes active cloud intrusions observed since May 2026. In the pattern it documented, unusual sign-ins were followed by threat-actor-added authentication methods, Microsoft Graph activity, downloads from SharePoint and OneDrive, and email collection.
That report illustrates what compromised identities can enable after access is obtained. It does not establish that those cases started with infostealer infections. For defenders, the practical lesson is to connect identity signals with cloud-application activity rather than examining a login in isolation.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How individuals can reduce the risk
Use phishing-resistant MFA for high-value accounts
CISA’s “More than a Password” guidance states: “The only widely available phishing-resistant authentication is FIDO/WebAuthn authentication.” A FIDO security key or a built-in platform passkey can prevent an attacker from completing a login on a fake website because the authenticator checks the legitimate site origin.
When choosing a physical security key, verify the account’s supported protocol, USB or wireless connection, device compatibility, enrollment and recovery process, and your organization’s policy. CISA’s ranking is general guidance, not a certification of every model. A key protects authentication; it does not remove malware or automatically invalidate a stolen browser session.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Limit the value of a single infected device
- Keep the operating system, browser and applications updated, and use reputable endpoint protection.
- Do not install pirated software, unofficial “updates” or browser extensions from untrusted sources.
- Use unique passwords for important accounts and store them in a reputable password manager so one exposed password does not unlock several services.
- Review active sessions, recent sign-ins, recovery addresses and newly added authentication methods after a suspicious alert.
- For banking, brokerage, payment and cryptocurrency accounts, turn on every security control the provider supports and use transaction alerts so unauthorized activity is noticed quickly.
Act quickly after a suspected infection
- Stop using the affected device for sensitive logins and disconnect it from networks when doing so will not destroy needed evidence.
- From a known-clean device, change the most important passwords, starting with email and financial accounts.
- Revoke active sessions and tokens, sign out other devices and remove authentication methods or recovery options you did not add.
- Contact financial institutions and account providers through official channels, explain that credentials or sessions may have been stolen, and ask what additional restrictions they recommend.
- Have the device examined and remediated. Changing passwords alone does not prove that the infostealer is gone.
How organizations should defend against the pathway
Harden authentication
Require MFA on important accounts and prefer phishing-resistant FIDO/WebAuthn methods where the service supports them. CISA identifies physical security keys and number-matching authenticator applications as stronger common choices than one-time codes sent by text or email. Treat SMS or email codes as a fallback rather than the target state for privileged access.
Watch the signals that follow a stolen identity
- Unusual sign-ins, impossible travel, unfamiliar devices and sudden changes in session or token behavior.
- Newly enrolled authentication methods, changed recovery information and unexpected consent or application registrations.
- Microsoft Graph calls and unusual access to SharePoint, OneDrive, Exchange or other cloud data stores.
- Large or atypical downloads, mailbox searches and activity that crosses several attack surfaces.
Microsoft’s cloud-incident guidance recommends investigating across identity, Microsoft Graph, SharePoint, OneDrive and Exchange signals. Correlation is important because a valid login can look harmless until it is connected to an authentication-method change or unusual data collection.
Prepare the response before an incident
Document who can revoke sessions, disable accounts, remove authentication methods, preserve logs and contact affected users. In a confirmed cloud compromise, Microsoft recommends revoking sessions and removing unauthorized authentication methods while investigating the related identity and cloud activity. CISA’s LummaC2 advisory provides threat details, indicators and organizational mitigations; teams should obtain the current advisory and validate indicators before operational use.
Bottom line
Infostealers help turn endpoint infections into identity attacks by supplying reusable credentials and, more urgently, browser session material. Criminal resale makes that data available to access brokers and other operators. Strong, phishing-resistant MFA, session and cloud monitoring, rapid token revocation and disciplined incident response address different parts of the chain. No password manager, security key or endpoint product by itself prevents every stage, and the available figures describe provider-specific observations rather than a universal global rate.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
