Infostealer malware hits 72% of firms studied

Malware reaches most firms

Infostealer malware exposed at least one employee or customer login at 72% of the 4,824 companies analysed across the US and Europe over the past year, according to research published by Swedish cybersecurity company Outpost24.

Most logins are old

The study identified 31.5 million exposed credentials in total. Around 30.7 million, or 97% of the total, came from breach dumps and combolists, collections of previously leaked usernames and passwords circulated among cybercriminals.

Fresh infections are rare

The remaining 844,000 credentials, fewer than 3% of the total, were extracted directly from infected devices using infostealer malware. These attacks also collect session cookies, which allow users to remain logged into services.

Employee and customer accounts differ

At 41% of firms, at least one stolen credential was linked to a work email address, suggesting an employee's device had been infected. Another 31% had malware-related credentials linked exclusively to customer accounts.

“An infostealer doesn't stop at one password. It can take session cookies, saved credentials, and access to multiple accounts.”

Severity depends on context

Outpost24 advises security teams to treat an infostealer detection as a possible sign of wider compromise, not simply reset the password.A single infected employee laptop could give attackers access to active sessions inside company systems.

“Thousands of stolen customer logins tell a very different story from a handful of compromised employee accounts.”