The rise of artificial intelligence has introduced a new frontier for theft with five percent of stolen secrets now involving platforms like OpenAI. As cloud environments become more hardened against traditional external attacks, the focus of cybercriminals has shifted from the infrastructure itself to the individuals who manage it. This identity-centric methodology relies heavily on infostealer malware, which targets the digital keys used by developers and administrative staff. Instead of hunting for zero-day vulnerabilities in a cloud provider’s backbone, attackers now prefer the path of least resistance: harvesting valid credentials and session tokens directly from local machines. Once these secrets are exfiltrated, unauthorized individuals can log into corporate consoles with the same level of authority as a trusted employee. This evolution has fundamentally changed the nature of defense, moving the primary challenge away from blocking unauthorized intrusions toward identifying and stopping legitimate-looking logins that originate from stolen identity data. Such a shift necessitates a fundamental re-evaluation of how organizations protect their most sensitive digital assets in 2026.
The Failure of MFCircumventing Active Session Tokens
A critical finding in the rise of infostealers is their ability to circumvent multi-factor authentication with ease. While MFA provides an essential layer of security, it is not a foolproof defense against modern malware. When a user logs into a service, the browser generates and stores a session token to maintain an authenticated state. Infostealers are specifically designed to exfiltrate these active tokens. If an attacker successfully imports a stolen token into their own browser, the cloud service recognizes them as the already-authenticated user, effectively bypassing the initial MFA prompt entirely. This technique, often referred to as session hijacking or token dancing, renders traditional second-factor challenges moot. Because the cloud provider assumes the user has already cleared the necessary security hurdles, the attacker is granted immediate access to sensitive data and administrative controls without ever needing to interact with the victim’s physical MFA device or biometrics. Because these tokens are frequently valid for hours or even days, the window for damage is extensive, making the stolen session a more valuable asset than a simple password.
The Failure of MFPart 2. Exploiting Persistent Developer Credentials
This security risk is significantly worsened by the presence of long-lived credentials within developer environments. In many organizations, AWS access keys, Azure CLI tokens, or Google Cloud service-account keys are stored in local configuration files for convenience. Because these credentials often do not expire quickly, they provide attackers with a durable, long-term window for programmatic access to production environments. This persistent access allows malicious actors to monitor internal activities and plan further movements without needing to re-authenticate or trigger new security alerts. The lack of automated rotation for these local secrets means that once a machine is compromised, the attacker essentially owns the associated cloud permissions until the keys are manually revoked. This convenience-first approach to developer workflows creates a massive vulnerability that infostealers are perfectly positioned to exploit, as they can silently sweep up these high-value configuration files during their initial infection phase. The convenience of keeping these keys locally has created a significant blind spot in corporate security postures.
Target Analysis: Breaching Major Cloud Provider Environments
The impact of these thefts is felt most acutely across major cloud ecosystems, with Amazon Web Services secrets representing nearly half of all compromised cloud data. Attackers specifically target account configuration and secret key files located in local directories, as well as command-line interface and single sign-on caches that can yield temporary but powerful credentials. Similarly, in Microsoft Azure environments, malware scans for local caches and identity files like the token cache to reveal subscription details and tenant information, enabling deep lateral movement within an organization’s directory. By harvesting these specific files, attackers can reconstruct the target’s cloud architecture and identify the most vulnerable or valuable assets. This focused approach allows them to bypass the perimeter entirely, entering the environment through the front door with legitimate permissions. The scale of this problem is reflected in the sheer volume of logs appearing in underground markets, where AWS and Azure access remain the most sought-after prizes for cybercriminals.
Target Analysis: Part 2. Risks to Code Repositories and AI Services
Google Cloud and various developer platforms are also high-value targets for infostealer operators. On developer machines, command-line credentials and service-account paths provide long-term access to critical production projects. Beyond the big three cloud providers, GitHub tokens are frequently stolen, exposing proprietary code and sensitive variables used in automated deployment pipelines. Gaining access to a private repository allows an attacker to analyze software for further vulnerabilities or even inject malicious code directly into the production stream. Even AI infrastructure is now at risk, as stolen keys for platforms like OpenAI lead to unauthorized service costs or the exposure of sensitive internal chat histories. As artificial intelligence becomes more integrated into business operations, these keys represent a growing target for theft, illustrating the expanding scope of the underground data economy. The intersection of code management and AI services creates a complex web of dependencies where a single stolen token can lead to a multi-platform catastrophe.
The Lifecycle of Stolen DatUnderground Marketplaces
Once an infostealer successfully harvests data, the logs enter a sophisticated underground marketplace where initial-access brokers validate and resell them to specialized criminals. This means a single accidental download by an employee can lead to a full-scale corporate breach within hours. These brokers utilize automated tools to sort through thousands of infections, identifying high-value corporate targets and filtering out less profitable individual users. Once a log is verified to contain corporate cloud access, it is auctioned off to the highest bidder, who then uses the access for data exfiltration, ransomware deployment, or long-term espionage. This specialized division of labor within the cybercrime ecosystem ensures that even low-level malware can facilitate high-impact state-level or corporate attacks. The efficiency of this market means that the time between the initial infection and the final breach is constantly shrinking, leaving security teams with a very narrow window to detect and remediate the compromise.
The Lifecycle of Stolen DatPart 2. Strategic Remediation
To properly recover from an infection, organizations isolated the affected device and immediately revoked all active sessions. Every password, API key, and cloud credential present on the machine was rotated from a known-secure device to prevent re-compromise. To prevent future incidents, companies moved toward using short-lived credentials and managed vaults, ensuring that even if a key was stolen, its usefulness was extremely limited. Implementing device-based access controls further secured the environment by ensuring that stolen tokens could not be used from unrecognized or unmanaged hardware. Security leaders also prioritized the monitoring of session activity for anomalies, such as logins from unexpected locations or unusual API calls. By shifting the defense strategy from simple malware removal to comprehensive identity management, organizations successfully addressed the root cause of these breaches. They recognized that in the modern era, protecting the endpoint meant protecting the identity of the person using it, rather than just the physical hardware itself.
