Attack #7: Malware & Infostealers

When data and access are quietly extracted

Threat snapshot – Malware & Infostealers

How the attack works

Malware and infostealers rarely aim to disrupt immediately.
They aim to remain unnoticed.

Attackers deliver malicious code through phishing emails, downloads, compromised websites, or infected software packages. Once executed, the malware begins collecting data in the background.

Infostealers specifically target:

• browser-stored credentials
• session tokens
• cookies
• saved payment information

This allows attackers to bypass passwords entirely and reuse active sessions.

In many cases, the user does not notice anything unusual.

The attack succeeds quietly.
And the consequences appear later.

Real-World Cases

Malware and infostealer campaigns rarely end with a single infected device. Their primary objective is to steal credentials, tokens, and active sessions that can later be used to access corporate environments.

CircleCI (2022–2023)

Sector: DevOps and Software Development

How did the incident begin?
Malware infected an engineer’s laptop and stole an active SSO (Single Sign-On) session by extracting a session cookie.

What was compromised?

• customer environment variables;
• API tokens and cryptographic keys;
• other sensitive secrets.

How did the attack develop?
Using the stolen session, the attackers accessed production systems and exfiltrated sensitive information. CircleCI subsequently required customers to rotate their secrets.

Operational and financial impact

• large-scale token and key rotation;
• customer investigations into possible follow-on access;
• temporary production access restrictions.

What could have reduced the impact?

• Endpoint Detection and Response (EDR);
• short-lived tokens and session cookies;
• least-privilege access;
• monitoring of active user sessions.

Snowflake Customer Campaign (2024)

Sector: Cloud Services

How did the incident begin?
Attackers used credentials previously stolen by infostealer malware. Some compromised accounts did not have Multi-Factor Authentication (MFA) enabled.

What was compromised?

• customer Snowflake accounts;
• databases and sensitive business information;
• data belonging to multiple international organizations.

How did the attack develop?
After successfully authenticating, the attackers exfiltrated large volumes of data for extortion or sale. The campaign affected several well-known organizations, including Ticketmaster and Santander.

Operational and financial impact

• sensitive data stolen from multiple organizations;
• investigation and recovery costs;
• mandatory credential rotation.

What could have reduced the impact?

• mandatory Multi-Factor Authentication (MFA);
• prompt credential rotation;
• monitoring for unusual logins and bulk exports;
• least-privilege access controls.

What do these incidents show?

In CircleCI, malware enabled attackers to steal an active user session and gain access to sensitive customer data. In the Snowflake campaign, credentials stolen by infostealer malware were later used to access cloud environments and exfiltrate large volumes of information.

Both incidents demonstrate that a single infected endpoint can become the starting point for a much larger compromise. Protecting endpoints, rotating compromised credentials, and continuously monitoring user sessions are essential for reducing the impact of malware and infostealer attacks.

Who they most often target

Malware does not target organizations directly.
It targets access points.

Roles

• employees using email and browsers
• remote workers
• IT users with elevated access
• contractors and third-party users

Sectors

• all sectors
• especially organizations with distributed workforce
• SaaS-heavy environments
• companies relying on browser-based workflows

Organization types

• organizations without strong endpoint protection
• environments with unmanaged devices
• companies allowing personal device usage (BYOD)
• fast-growing teams with inconsistent security controls

The weakest endpoint often becomes the entry point.

What the attack relies on

Malware succeeds through a combination of user behavior and technical gaps.

Human factors

• clicking malicious links
• downloading untrusted files
• installing unknown software
• ignoring security warnings

Technical gaps

• missing endpoint detection
• outdated systems
• weak browser security
• lack of monitoring

Process weaknesses

• lack of device management
• no control over software installation
• insufficient patching
• no incident detection processes

Infostealers rely on what is already stored and trusted inside the system.

How it is detected

Detection often depends on behavioral signals.

What users may notice

• slow system performance
• unexpected browser behavior
• unknown applications

What IT teams observe

• unusual outbound traffic
• unknown processes
• suspicious system activity

What SOC teams detect

• credential harvesting patterns
• communication with command-and-control servers
• abnormal authentication behavior
• reuse of stolen sessions

The earlier the detection, the lower the downstream impact.

How impact is contained

Containment must focus on identity and device control.

Immediate priorities include:

• isolating affected endpoints
• resetting compromised credentials
• invalidating active sessions and tokens
• removing malicious software
• reviewing access activity

What does not help:

• assuming the issue is limited to one device
• delaying credential reset
• ignoring session-based compromise

Malware is often only the first step in a larger attack chain.

What realistically helps

Reducing malware risk requires layered protection.

People

• awareness around downloads and links
• understanding browser risks
• reporting suspicious behavior

Processes

• device management policies
• patch management
• software control
• incident response readiness

Technology

• endpoint detection and response (EDR)
• browser protection
• network monitoring
• identity protection

Prevention reduces exposure. Detection reduces impact.

Common myths

“Antivirus is enough”
“If nothing is visible, nothing is happening”
“Only large organizations are targeted”
“Strong passwords are sufficient”

In reality, infostealers bypass passwords by stealing sessions and stored credentials.

Attack #1: Phishing & Social Engineering

Attack #2: Credential Abuse & Account Takeover

Attack #3: Business Email Compromise (BEC)

Attack #4: Ransomware

Attack #5: Supply Chain Attack

Attack #6: Insider Threat

Next: Attack #8 – Data Exfiltration