Infostealers : Why Your EDR No Longer Protects Your Credentials

What is an infostealer and why does it matter so much?

Short answer: an infostealer is a lightweight piece of malware whose only purpose is to siphon credentials (browser-saved passwords, session cookies, authentication tokens, crypto wallets) and then disappear. The stolen data is sold to initial access brokers, who resell it to ransomware groups. Ransomware deployment often follows within 48 hours.

Infostealers are not spectacular. They encrypt nothing, display no ransom note, disrupt nothing for the user. An infection typically lasts a few minutes, just long enough to exfiltrate a data package, then the process exits. That is exactly what makes it dangerous: nothing alerts the victim.

The volume is industrial. 2026 analyses count hundreds of millions of credentials and billions of session cookies recovered from underground sources over the previous year alone, originating from millions of distinct infections. A single infection exposes roughly fifty credentials on average : for a work device, that means VPN, email, CRM and cloud console access.

The uncomfortable number: 40% of infections on protected endpoints

Roughly 40% of infostealer infections are observed on endpoints that were running EDR or antivirus. That figure deserves a careful reading: it does not mean EDR is useless, it means endpoint protection does not protect identity.

Three reasons explain the bypasses:

The real issue: session cookies bypass MFA

Many organizations assume multi-factor authentication neutralizes a stolen password. That is true for the password alone. It is not true for the session cookie.

A session cookie is proof, already validated, that authentication succeeded. An attacker who imports it into their own browser lands inside the session, with no password and no second factor. No sign-in alert, no MFA challenge : as far as the system is concerned, you simply kept browsing.

This is why responding to an infostealer infection cannot stop at a password reset. Sessions must be invalidated.

The full chain, from endpoint to ransomware

This chain explains something important for incident response: when ransomware fires, the initial compromise may be months old and may have originated on a device the organization does not even own.

Seven controls that actually break the chain

What we see in forensics

In our incident response files the pattern repeats: the organization has decent EDR, broadly deployed MFA, working backups. The attacker entered through an out-of-perimeter device (a contractor's personal laptop, an employee's home machine) with a valid session cookie and an inherited VPN session. None of those steps raised an alert, because none of them was technically abnormal.

The operational lesson is simple: the perimeter to defend is no longer the endpoint, it is the identity and the session.

Conclusion

Infostealers have become the fuel of the initial access market, and therefore the first step in most ransomware incidents we handle in Canada. Defending against them requires moving controls toward identity: session lifetimes, device binding, fast revocation, phishing-resistant MFA and leak monitoring. ITCS Group runs identity exposure assessments, session-theft-focused penetration tests and 24/7 incident response. Contact us to find out what is already circulating on your credentials.

Sources