Fact Friday: infostealers and the credential economy.
Infostealer malware rarely makes the front page, but it accounts for a significant share of the credentials circulating in criminal markets right now. The mechanic is straightforward: a device is compromised, the malware extracts saved passwords from browsers and applications, and those credentials are packaged and sold. The buyer then tests them at scale across other services.
Password reuse is what turns one breach into many. A set of credentials leaked from a low-value consumer site can authenticate directly against a corporate VPN, a cloud admin console, or a business email account if the same password was used. We see evidence of this pattern in assessments regularly.
The controls worth prioritising are phishing-resistant authentication such as passkeys or hardware security keys (which aren't vulnerable to the relay techniques that defeat standard TOTP codes), a password manager enforced at organisational level so credential uniqueness isn't left to individual judgement, and ongoing monitoring for exposed credentials tied to your domain. The technology exists. The gap is almost always in whether it has actually been deployed and enforced consistently.