--- title: Your Employee’s Password Appeared in an Infostealer Log.... description: Infostealer malware like RedLine, Lumma, and Vidar harvests not just passwords but authenticated session cookies, browser autofill data, and VPN configs,... canonical: https://daily.dev/posts/your-employee-s-password-appeared-in-an-infostealer-log-now-what--klicydwij twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Your Employee’s Password Appeared in an Infostealer Log. Now What? | daily.dev og:description: Infostealer malware like RedLine, Lumma, and Vidar harvests not just passwords but authenticated session cookies, browser autofill data, and VPN configs,... og:url: https://daily.dev/posts/your-employee-s-password-appeared-in-an-infostealer-log-now-what--klicydwij og:image: https://api.daily.dev/og/posts/KlicyDWiJ.png og:image:alt: Your Employee’s Password Appeared in an Infostealer Log. Now What? og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Your Employee’s Password Appeared in an Infostealer Log. Now What? **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 7 min read · 0 upvotes · 0 comments ## Summary Infostealer malware like RedLine, Lumma, and Vidar harvests not just passwords but authenticated session cookies, browser autofill data, and VPN configs, potentially letting attackers bypass MFA entirely by replaying stolen sessions. Roughly 90% of stealer logs now circulate on Telegram, and about 46% of corporate credentials found in these logs originate from unmanaged personal devices. The piece, sponsored by security vendor Flare, outlines a triage framework prioritizing enterprise identity provider credentials and session cookies as critical severity (under one-hour response target), and walks through an investigation workflow: checking authentication telemetry, determining if stolen access is still usable, and looking for signs of account takeover such as new MFA device enrollment or unusual logins. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Can a stolen session cookie bypass multi-factor authentication? Yes, a stolen authenticated session cookie can let an attacker replay the session without triggering a login or MFA prompt at all, effectively bypassing MFA. This differs from stolen credentials alone, which still require authentication and give defenders a chance to detect or block the login attempt. _Teams tracking account takeover risk from session hijacking can follow identity security coverage on daily.dev._ ### What percentage of stealer logs with corporate credentials come from personal devices? Approximately 46% of stealer logs containing corporate credentials originate from likely unmanaged or personal devices, according to Flare Research's analysis. Exposure of credentials and sessions tied to major productivity SaaS and cloud services is also estimated to be growing about 29% annually. _Security practitioners weighing BYOD and identity exposure risks can find related analysis on daily.dev._ ### How should security teams prioritize which exposed credentials in an infostealer log to investigate first? Enterprise identity provider credentials combined with session cookies should be treated as critical severity with a response target of under one hour, since a compromised SSO identity like Microsoft Entra ID or Okta can open access to multiple connected applications. VPN or RDP access paired with multiple corporate credentials ranks as high severity due to lateral movement risk. _Incident responders building credential-exposure triage playbooks can track this kind of guidance on daily.dev._ ## Similar posts on daily.dev - [Beyond Credentials: The Hidden Ecosystem of InfoStealers and the Log Economy](https://daily.dev/posts/beyond-credentials-the-hidden-ecosystem-of-infostealers-and-the-log-economy-e4uemsylx) · InfoSec Write-ups · 0 upvotes · 0 comments - [Why Simple Breach Monitoring is No Longer Enough](https://daily.dev/posts/why-simple-breach-monitoring-is-no-longer-enough-ekkeyqqxv) · BleepingComputer · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cloud](https://daily.dev/tags/cloud), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/your-employee-s-password-appeared-in-an-infostealer-log-now-what--klicydwij) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Your Employee’s Password Appeared in an Infostealer Log. Now What?","url":"https://daily.dev/posts/your-employee-s-password-appeared-in-an-infostealer-log-now-what--klicydwij","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/your-employee-s-password-appeared-in-an-infostealer-log-now-what--klicydwij"},"datePublished":"2026-09-03T13:55:49.363Z","dateModified":"2026-09-03T14:11:31.939Z","description":"Infostealer malware like RedLine, Lumma, and Vidar harvests not just passwords but authenticated session cookies, browser autofill data, and VPN configs,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/59aa5990c5c93beb67d902b4f36c13ba?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/59aa5990c5c93beb67d902b4f36c13ba?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/your-employee-s-password-appeared-in-an-infostealer-log-now-what--klicydwij","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cloud,malware","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"Your Employee’s Password Appeared in an Infostealer Log. Now What?"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/your-employee-s-password-appeared-in-an-infostealer-log-now-what--klicydwij#faq","mainEntity":[{"@type":"Question","name":"Can a stolen session cookie bypass multi-factor authentication?","acceptedAnswer":{"@type":"Answer","text":"Yes, a stolen authenticated session cookie can let an attacker replay the session without triggering a login or MFA prompt at all, effectively bypassing MFA. This differs from stolen credentials alone, which still require authentication and give defenders a chance to detect or block the login attempt. Teams tracking account takeover risk from session hijacking can follow identity security coverage on daily.dev."}},{"@type":"Question","name":"What percentage of stealer logs with corporate credentials come from personal devices?","acceptedAnswer":{"@type":"Answer","text":"Approximately 46% of stealer logs containing corporate credentials originate from likely unmanaged or personal devices, according to Flare Research's analysis. Exposure of credentials and sessions tied to major productivity SaaS and cloud services is also estimated to be growing about 29% annually. Security practitioners weighing BYOD and identity exposure risks can find related analysis on daily.dev."}},{"@type":"Question","name":"How should security teams prioritize which exposed credentials in an infostealer log to investigate first?","acceptedAnswer":{"@type":"Answer","text":"Enterprise identity provider credentials combined with session cookies should be treated as critical severity with a response target of under one hour, since a compromised SSO identity like Microsoft Entra ID or Okta can open access to multiple connected applications. VPN or RDP access paired with multiple corporate credentials ranks as high severity due to lateral movement risk. Incident responders building credential-exposure triage playbooks can track this kind of guidance on daily.dev."}}]} ```