Infostealers Now Source of 75 Percent of Stolen Credentials, Immersive Says

Cybersecurity vendor Immersive reports that infostealer malware families are now responsible for 75 percent of all stolen credentials. This significant shift highlights a broader trend where attackers favor automated tools over complex, custom exploits to gain initial access to corporate networks.

The rise of infostealers such as Lumma Stealer, StealC, and RisePro has accelerated over the past 18 months. These tools harvest sensitive data including browser cookies, VPN credentials, multi-factor authentication tokens, and cryptocurrency wallet information. According to Immersive, this data is then sold on dark web markets, providing buyers with ready-made access to targeted systems.

The Commoditization of Initial Access

Ben McCarthy, lead cyber security engineer at Immersive, notes that this dynamic effectively commoditizes initial access. By purchasing stolen credentials, attackers can achieve objectives that might otherwise require sophisticated, resource-intensive campaigns. McCarthy told CSO Online that this shift allows even less skilled actors to pursue goals typically associated with nation-state operations through simple transactions.

This evolution reflects a broader change in the malware landscape, driven by advances in artificial intelligence and shifting computing infrastructures. The traditional adversarial dynamic has intensified, with fresh techniques replacing older, less effective methods. Security professionals must continuously update their knowledge to defend against these increasingly sophisticated threats, as noted by CSO Online in its recent analysis of rising malware trends.

Targeting Developer Environments

Threat actors are also systematically compromising software supply chains by embedding malicious code within legitimate development tools. These attacks exploit the inherent trust developers place in package repositories like NPM, PyPI, and AI platforms such as HuggingFace. McCarthy explained to CSO Online that malicious packages often mimic legitimate ones while executing harmful code, thereby evading standard code review processes.

In 2026, attackers demonstrated further innovation in supply chain targeting. The Shai-Hulud campaigns involved self-propagating malware that stole continuous integration and deployment secrets. This malware hijacked GitHub Actions OIDC tokens to publish malicious package versions through the victims’ own release pipelines, effectively turning the build process into a distribution vector.

Lindsey O’Donnell-Welch, principal technical writer at managed detection and response firm Huntress, highlighted another tactic in the Axios compromise. In that incident, attackers targeted the lead maintainer’s credentials and inserted a malicious dependency into legitimate software releases. This approach allows adversaries to distribute malware directly to end users who trust the affected software packages.

What should you do?

Organizations should monitor their networks for indicators of compromise associated with known infostealer families like Lumma and StealC. Security teams must also audit third-party dependencies in their software development lifecycles, verifying the integrity of packages downloaded from public repositories.

What to do and how to stay safe: Lumma Stealer

• Review authentication logs for unusual activity that may indicate the use of stolen MFA tokens or browser cookies.
• Audit your software bill of materials to identify dependencies from high-risk repositories like NPM and PyPI.
• Implement strict access controls for CI/CD pipelines and restrict the permissions of OIDC tokens used in build processes.
• Monitor dark web forums for sales of credentials related to your organization or industry sector.

Step-by-step guide: Endpoint Detection and Response Examples: How EDR Stops Hidden Threats

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which infostealer families are most prevalent according to Immersive?

Immersive identifies Lumma Stealer, StealC, and RisePro as the primary infostealers responsible for the majority of credential theft.

How are attackers exploiting software supply chains in 2026?

Attackers are using self-propagating malware to steal CI/CD secrets and hijack tokens to publish malicious packages through victim pipelines.

What data do infostealers typically target?

These tools steal browser cookies, VPN credentials, multi-factor authentication tokens, and cryptocurrency wallet data.