Infostealer logs, the dumps of browser cookies, saved passwords, and authentication tokens harvested from compromised endpoints, have made session token theft the dominant credential attack in 2026. The password is no longer the thing the attacker wants. The active session is. The shift happened over roughly 18 months, accelerated by the Snowflake campaign in 2024 and 2025, and it has fundamentally changed what the defender has to protect. The password can be rotated. The session, once stolen, can be used until it expires. The defender is now in a race against the infostealer economy, and the defender is losing the parts of the race that matter.
What the attacker has
The infostealer market in 2026 is a mature criminal economy. LummaC2, Raccoon, Vidar, RedLine, and a dozen other stealer families are sold as malware as a service subscriptions. The stealer runs on the victim’s machine, harvests browser cookies, saved passwords, autofill data, and any authentication tokens the browser holds, then exfiltrates the dump to a collection server. The collection server sells the dump to other criminals on forums like Genesis (despite law enforcement seizures, successors exist), Russian Market, and a handful of others. The price for a single dump ranges from roughly 5 dollars for an unverified consumer dump to several hundred dollars for a corporate SSO session token. The market is liquid, automated, and global.
The down stream attacker who buys the dump does not need the password. The password can be rotated, MFA can be re enrolled, and the legitimate user can be notified. The attacker needs the session token. The session token is, in many implementations, a long lived bearer token that the authentication system trusts without further checks. The token is good for hours, days, or weeks. The attacker uses the token, the legitimate user continues to work, and the defender sees no anomaly because the session is technically valid. The defender’s only signal is the IP address, the user agent, and the geographic origin. All of these are easy to spoof.
What the defender has to do
Three moves, in priority order. The first is short lived sessions. Every session token in the enterprise should have a lifetime measured in hours, not days. The friction is real, but the security win is the elimination of the long lived bearer token that the infostealer economy is built to harvest. Microsoft Entra, Okta, and Google Workspace all support session lifetime policies in 2026. The default is still too long. The defender has to set it shorter and live with the reauthentication friction. The second move is device bound session tokens. The token should be cryptographically bound to the device it was issued to. A token stolen from a Windows machine cannot be replayed from a Linux server. FIDO2 derived credentials, where the session token is bound to the device’s hardware key, are the strongest version of this. Microsoft, Google, and the major SaaS vendors are rolling this out through 2026. The third move is identity threat detection. The defender’s EDR and identity platform should be watching for token replay, impossible travel, and suspicious session behaviour. Push Security, Obsidian, and Microsoft Defender for Identity all do some version of this. The detection is not perfect. The detection catches the dumb attackers and the ones who do not carefully mimic the victim’s behaviour.
The bottom line
Short lived sessions, device bound tokens, identity threat detection. The session is the new credential. Rotate it, bind it to a device, watch it. The password alone cannot defend the enterprise. The session token has to be defended in depth.
Sources & Further Reading
All claims in this article are sourced from primary documentation, vendor advisories, and reputable security researchers.
Spotted an error? Email the editor. Corrections are issued with a visible correction note.
Editorial standards. Every article on humanrequired.org is reviewed by a human editor before publication. AI may assist with drafting or research; final editorial control is human. Read the full standards.
