Three Malware Families Drive 85.7% of Infostealer Cloud Breaches

A Concentrated Threat Landscape

Infostealer malware has become a leading initial access vector into enterprise cloud, code, and AI environments, according to security firm Wiz. The attacks typically start on unsecured endpoints — often personal devices — where threat actors use social engineering and supply chain attacks to steal credentials, API keys, and active session tokens. Microsoft, Recorded Future, and Verizon's Data Breach Investigations Report have each flagged stolen credentials as a leading cause of concern. Rather than being built in-house, the malware is rented: Malware-as-a-Service platforms offer tools like Lumma and RedLine for a few hundred dollars a month, designed to scrape credentials and exfiltrate data within seconds of execution.

Cloud Credentials Are the Primary Yield

Wiz's analysis of secrets detected on infected machines — run through its integration with threat-intelligence provider NordStellar — found that AWS and GCP credentials make up the largest share of what infostealers harvest, reflecting how much cloud access now sits in files on developer laptops. In AWS environments, attackers target long-term IAM access keys stored in plaintext configuration files, plus the AWS Management Console session cookie, which lets them bypass MFA entirely once stolen. In GCP, the equivalent targets are two SQLite databases used by the gcloud CLI: credentials.db, which stores long-lived OAuth 2.0 refresh tokens that Wiz says generally do not expire unless an administrator explicitly revokes them, and access_tokens.db, which stores the shorter-lived active access tokens the CLI mints from those refresh tokens to call Google's APIs.

Code and AI Platforms Are Now on the Target List

GitHub access — through App Tokens, OAuth tokens, and Personal Access Tokens — accounts for roughly 10% of stolen secrets, Wiz found, putting source-code repositories in the same target category as cloud consoles. AI platform credentials make up 5%, led predominantly by OpenAI API keys. Wiz notes these are lucrative because attackers can run their own workloads on someone else's account or resell access through the illicit LLM resale market, and potentially reach historical chat logs that may contain corporate data — though Wiz says it has not observed public cases of that specific outcome. NordStellar has separately catalogued more than 400 distinct types of non-credential secrets harvested from infected machines, indicating attackers monetize whatever access they obtain rather than targeting a narrow set of assets.

Bypassing MFA Without Breaking It

Rather than attacking multi-factor authentication directly, infostealer operators steal the session token a device already holds after a user has logged in, then replay it in their own browser to inherit that access — no MFA prompt required. Wiz singles out AWS IAM Identity Center as a specific exposure point: when a user authenticates via SSO, the resulting OIDC tokens are cached locally and can remain valid for up to 90 days unless the user logs out or an administrator revokes the session. Wiz also points to Miasma, a newer strain of infostealer-like malware that skips phishing altogether, instead hijacking a software dependency's latest release to inject malicious code directly into CI/CD pipelines, development servers, and build processes.

What Budget-Holders Should Ask