GoKawiilFlare research finds nearly half of leaked corporate credentials trace to personal devices
A new practitioner's guide from Flare Research examines how infostealer malware like Vidar, RedLine and Lumma harvest corporate logins, browser cookies and saved credentials from infected machines. The study found that about 46% of stealer logs containing corporate credentials came from likely unmanaged or personal devices, and that exposure of credentials and sessions tied to major SaaS and cloud platforms is climbing roughly 29% each year.
GoKawiil's interpretation of the reporting above, not reported fact.
Password resets alone often fail to close the exposure because attackers can reuse stolen session cookies to bypass MFA entirely, especially when the compromised device sits outside IT's control. As stolen credential data increasingly circulates in underground marketplaces and Telegram channels, security teams face growing pressure to triage which exposures represent active threats versus stale, irrelevant leaks.
- 46% of corporate credentials in infostealer logs originate from personal or unmanaged devices, complicating remediation.
- Stolen session cookies can let attackers bypass password resets and MFA, making credential rotation alone insufficient.
- Exposure of SaaS and cloud credentials via infostealers is growing about 29% annually, raising urgency for monitoring.
Yubico YubiKey 5 NFC Security Key — When stolen passwords and session cookies show up in infostealer logs, phishing-resistant hardware authentication is the strongest lever defenders have. The YubiKey 5 NFC plugs into USB-A or taps an NFC phone to provide FIDO2/WebAuthn logins for major SaaS accounts, so a leaked password alone doesn't hand over the account. It's a durable, battery-free key that's easy to roll out to employees working from personal machines.
See Yubico YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-09-03
Published there as: “Your Employee’s Password Appeared in an Infostealer Log. Now What?”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.