Infostealers and the credential you never issued
Why the compromise that gets you may never touch a device you manage, and what to do about it.
The shape of the problem
An employee saves a corporate password in a browser on a personal laptop. Something on that laptop harvests everything the browser has stored: credentials, autofill data, and session cookies.
The results are packaged and traded in bulk. Weeks or months later someone buys the bundle, finds your domain in it, and logs in.
Nothing on your network produced an alert, because nothing on your network was involved until the moment a valid credential was used correctly.
Why this defeats controls that otherwise work
Endpoint protection did not see it, because the endpoint was not yours. Impossible-travel and anomalous login detection help, but they are probabilistic and they fire after the fact.
Session cookies are the part most often underestimated. A stolen live session can be replayed without ever presenting a password, which means it can sidestep multi-factor authentication entirely. Rotating the password does not invalidate it. Only revoking the session does.
What actually helps
Look outside your estate. The only point at which this is detectable before use is when the credential appears in circulation. That means continuous monitoring of stealer-log and breach-data sources, matched against your identity estate rather than against a generic feed.
Match on more than exact passwords. Reuse and partial reuse are what credential stuffing actually exploits, so matching only on exact strings will miss most of the real exposure.
Revoke sessions, not just passwords. Make session revocation part of the standard response to a credential appearing, because password rotation alone leaves the stolen cookie working.
Watch for the pattern. Repeat appearances from one team or one supplier tell you something about a device, a habit or a relationship, and that is more valuable than the individual finding.
The supplier dimension
The same applies to the organisations you depend on. A supplier whose staff credentials are circulating is a supplier whose access to your systems is at risk, and you will usually learn about it from your own monitoring long before you learn about it from them.
Questions, answered
Does multi-factor authentication solve this?
We cannot control personal devices. What can we do?
Where this goes next
Want this applied to your estate?
Tell us what you are protecting and where you feel exposed. We will map it to the right capabilities and set up a walkthrough.