3 MIN READ
Picture a credential theft investigation in March 2026. The password was not the thing that got stolen. The active session was. The shift happened over roughly eighteen months, accelerated by the Snowflake campaign in 2024 and the wave of corporate SSO dumps that followed. Defenders are now defending a different kind of credential, and the controls that worked against password theft do not work here. The infostealer economy is built to harvest the session, not the password.
The infostealer economy in 2026
LummaC2, Raccoon, Vidar, RedLine, and a dozen other stealer families are sold as malware as a service subscriptions. The stealer runs on the victim’s machine, harvests browser cookies, saved passwords, autofill data, and any authentication tokens the browser holds, then exfiltrates the dump to a collection server. The collection server sells the dump on forums like Genesis (successor markets exist despite the law enforcement seizures), Russian Market, and a handful of others. A single dump runs from around five dollars for an unverified consumer bundle to several hundred dollars for a corporate SSO session token. The market is liquid, automated, and global.
The downstream buyer does not need the password. Passwords can be rotated, MFA can be re enrolled, and the legitimate user can be notified. What gets used is the session token, which in many implementations is a long lived bearer token that the authentication system trusts without further checks. The token is good for hours, days, or weeks. The legitimate user keeps working. Defenders see no anomaly because the session is technically valid. The only signals are the IP address, the user agent, and the geographic origin, and all three are easy to spoof.
What actually defends against it
Short lived sessions are the first move. Every session token in the enterprise should have a lifetime measured in hours, not days. The friction is real, and the security win is the elimination of the long lived bearer token that the infostealer economy is built to harvest. Microsoft Entra, Okta, and Google Workspace all support session lifetime policies in 2026, and the defaults are still too long. The defender has to set them shorter and live with the reauthentication friction.
Device bound session tokens are the second move. The token should be cryptographically bound to the device it was issued to. A token stolen from a Windows machine cannot be replayed from a Linux server. FIDO2 derived credentials, where the session token is bound to the device’s hardware key, are the strongest version of this, and Microsoft, Google, and the major SaaS vendors are rolling the capability out through 2026.
Identity threat detection catches what the rest misses. The EDR and identity platform should be watching for token replay, impossible travel, and suspicious session behaviour. Push Security, Obsidian, and Microsoft Defender for Identity all do some version of this. The detection is not perfect, and it catches the careless criminal and the one who does not carefully mimic the victim’s behaviour. That is enough to matter.
The bottom line
Short lived sessions, device bound tokens, identity threat detection. The session is the new credential. Rotate it, bind it to a device, watch it. The password alone cannot hold the line.
Sources & Further Reading
All claims in this article are sourced from primary documentation, vendor advisories, and reputable security researchers.
Spotted an error? Email the editor. Corrections are issued with a visible correction note.
Editorial standards. Every article on humanrequired.org is reviewed by a human editor before publication. AI may assist with drafting or research; final editorial control is human. Read the full standards.
