Infostealer Malware Exposes Most Firms' Credentials
Outpost24 found 72% of 4,824 surveyed organizations in the US and Europe had employee or customer credentials in infostealer logs.
Updated on Nov. 3, 2026 in Cybersecurity
A 12-month study by Outpost24 found that 72% of 4,824 organizations in the US and Europe had employee or customer credentials identified in infostealer malware logs. The findings highlight how stolen logins and session cookies can expose company accounts.
Why it matters
Infostealer malware collects saved logins and session cookies, and session cookies can let attackers reach accounts without a password. Recent attacks on Meta's GitHub repositories involved stolen employee credentials, illustrating the risk.
Of the identified credentials, about 31 million came from breach dumps and combolists, while 844,000 were taken directly from infected devices using infostealer malware. Less than 3% of exposed credentials originated from infostealer logs, and the study does not detail how the remaining exposures were collected.
The players
Outpost24
Outpost24 is a cybersecurity company that conducted the study identifying exposed credentials across 4,824 organizations in the US and Europe.
The details
Infostealer malware collects saved logins and session cookies from infected devices, and attackers can use session cookies to access accounts without entering a password. Outpost24 found that 41% of the surveyed organizations had at least one credential associated with a staff email address stolen by an infostealer.
Timeline
The credential identification study covered a 12-month period.
The article reporting the findings was published on November 3, 2026.
Threat Landscape
The Outpost24 findings extend the pattern seen in recent attacks on Meta's GitHub repositories, which involved stolen employee credentials. The data suggests such exposure is widespread across US and European organizations rather than confined to a single high-profile target.
Saved logins and active session cookies stored on a device can be captured by infostealer malware, potentially giving attackers access to accounts without a password. Users and employees should avoid storing credentials in browsers and monitor for suspicious account activity.
The takeaway
Session cookies can grant account access even without a password, so protecting devices from infostealer malware is as important as strong passwords. Organizations should monitor for stolen employee credentials across breach dumps and infected endpoints.
Further reading
For more on how attackers exploit stolen logins, explore the Cybersecurity section.
