Infostealers, and Why a Password You Changed Years Ago Can Still Burn You
Infostealer malware quietly harvests credentials and sessions from endpoints, and they circulate for years. Here is how the pipeline works and why enforced MFA is the control that defuses it.
A surprising share of breaches don't begin with a clever exploit. They begin with a username and password that were simply correct — harvested from someone's infected computer months or years earlier, and still working. The machinery behind that is the infostealer, and understanding its pipeline explains why "we have a password policy" is not the defense people think it is.
What an infostealer does
An infostealer is malware with a narrow, mercenary job: get onto an endpoint, scrape everything that looks like a credential, and exfiltrate it. It runs on a laptop or home PC — often arriving through a cracked application, a malicious download, or a vulnerable piece of consumer software — and then harvests:
- Saved passwords from browsers and password managers' local stores.
- Session cookies and tokens sitting in the browser, which (as bearer credentials) can let an attacker resume a logged-in session without the password at all.
- Anything credential-shaped in files: config files, notes, keys.
It does this quietly, often in seconds, and then it's gone. The victim usually never knows.
The pipeline, and why time doesn't help the victim
Here's the part that makes infostealers a structural problem rather than a one-off. The harvested credentials don't get used immediately by the person who stole them. They get sold. Infostealer logs flow into criminal marketplaces and are bought, traded, and aggregated. A credential harvested today might be used by a completely different attacker two years from now.
That long shelf life is the trap. The leak is silent, so the victim never rotates the password. The buyer eventually tries it against whatever account it belongs to. And if that account still accepts a username and password as sufficient, an old leaked credential is a working key — the age is irrelevant, because nothing ever required more than the credential.
Why this is really an MFA-enforcement story
The crucial point: a leaked password, by itself, is not an incident. Credentials leak constantly; that's the background weather of the internet. What turns a leak into a breach is an account that accepts the password alone.
This is exactly what multi-factor authentication is for — to make a leaked password insufficient by requiring a second thing the attacker can't pull from a years-old malware log. So the decisive control isn't password complexity or rotation policy; it's whether MFA is actually enforced on every account. "MFA is available" and "MFA is on everywhere, with no quiet exceptions" are very different states, and the gap between them is precisely where infostealer credentials cash in.
There's a wrinkle: infostealers also grab session cookies, and a stolen session can sidestep MFA, because the session represents a login that already happened. So enforced MFA is necessary but not sufficient — you also want short session lifetimes, session binding, and detection of logins from unfamiliar infrastructure.
What to actually do
- Enforce MFA everywhere — phishing-resistant where you can. Make it mandatory, audit for any account that can still log in with just a password, and treat those as your exposure.
- Assume your credentials are already in a dump. Monitor for your domains and users appearing in infostealer data, and force rotation when they do — before someone else tries them.
- Shorten and bind sessions, so a stolen cookie has the smallest, least-portable window possible.
- Alert on logins from new infrastructure to sensitive systems, even when the credentials are valid — because with infostealers, they will be.
- Harden endpoints, including the unmanaged ones. The harvest happens on a device; the less able a personal or under-managed machine is to reach sensitive access, the less a single infection is worth.
The takeaway
Infostealers turn one infected endpoint into a slow-burning supply of valid credentials that circulate for years, which is why a password you changed long ago — or never knew was stolen — can still open a door today. The control that defuses the whole pipeline is enforced MFA on every account, backed by session hygiene and the assumption that your passwords are already out there. They probably are.