Infostealers and the Logs Economy: Why Your MFA Did Not Help

A significant portion of identity breaches don't start with phishing or exploits, but rather with infostealers silently collecting credentials and session data from infected machines. The Snowflake customer intrusions, where UNC5537 leveraged old infostealer logs against customer tenants lacking MFA, exemplify this trend. Defenders need to treat these infections as identity incidents, not just malware tickets, and focus on revoking sessions, resetting passwords, and strengthening controls post-login, including device-bound sessions and SaaS access management. The market for these stolen logs is thriving, with automated marketplaces and Telegram channels facilitating the sale of compromised data.