The Infostealer Incursion: Stolen Credentials Breach Cloud, Code, and AI Environments
The Infostealer Incursion (TL-2026-2687), also tracked as Infostealer Incursion Campaign, is a high-severity malware campaign, first published 2026-09-27. It is attributed to Infostealer operators & Initial Access Brokers with low confidence, affects GitLab Inc. GitLab CE/EE (self-hosted), references 1 CVE (CVE-2023-7028), maps to 16 MITRE ATT&CK techniques (T1027, T1071.001, T1078.004), and is covered by 9 detection rules and 28 indicators of compromise.
Key facts for TL-2026-2687
- Threat ID
- TL-2026-2687
- Also known as
- Infostealer Incursion Campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-09-27
- Last reviewed
- 2026-09-27
- Attribution
- Infostealer operators & Initial Access Brokers
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, software development, cryptocurrency, cross-sector enterprise it, government administration
- Target regions
- Global, North America, Europe, india
- Detection rules
- 9
- Indicators of compromise
- 28
Malware and tooling in The Infostealer Incursion
Malware and tooling: AUDIOFIX, Amadey - S1025, Lumma / LummaC2, Lumma Stealer - S1213, MetaStealer, Miasma, RedLine Stealer - S1240, Stealc, Vidar / Vidar 2.0, miniRAT, PEASS-ng (linPEAS/winPEAS), nord-stream
Wiz Research analysis of NordStellar credential-exposure data shows an industrialized infostealer ecosystem (Lumma, RedLine, Vidar, StealC, Amadey, Miasma, Ghost Loader) accounting for the majority of harvested credentials, with Lumma+RedLine+Vidar alone representing 85.7% of observed theft. Stolen browser sessions, OAuth tokens, and local credential files now routinely grant attackers access to AWS, Azure/Entra ID, GCP, GitHub/GitLab CI/CD, and AI platforms including OpenAI ChatGPT and Anthropic Claude Code.
How The Infostealer Incursion works
Wiz Research's 'Infostealer Incursion' report (2026-09-25) analyzes credential-exposure telemetry from NordStellar's threat-exposure-management platform to show that commodity infostealer malware has become the primary initial-access vector into cloud, source-control, and AI environments. Three families -- Lumma (LummaC2), RedLine, and Vidar -- account for 85.7% of detected infostealer incidents and are rented on Malware-as-a-Service (MaaS) platforms for as little as a few hundred dollars a month, alongside StealC, Amadey, Miasma, and Ghost Loader. Distribution relies on trojanized gaming installers (fake Roblox.exe, 'Valorant SkinChanger.exe'), abuse of legitimate signed Windows binaries (vbc.exe), and, notably, exploitation of the maximum-severity GitLab authentication-bypass flaw CVE-2023-7028 (CVSS 10.0, CISA KEV) by the Amadey loader to distribute StealC via a compromised self-hosted GitLab instance.
Once resident on a host, these stealers systematically target cloud CLI credential stores rather than just browser passwords: AWS's plaintext ~/.aws/credentials and ~/.aws/sso/cache (OIDC tokens valid up to 90 days); Azure's .azure/accessTokens.json and MSAL token cache, with Vidar 2.0 adding dedicated enumeration of %USERPROFILE%\.azure and the azureProfile.json subscription/tenant manifest; and GCP's credentials.db/access_tokens.db OAuth refresh-token stores and $GOOGLE_APPLICATION_CREDENTIALS service-account keys. Roughly half of tracked infostealer families now actively collect GitHub credentials (OAuth tokens, PATs, SSH keys, and the __Host-user_session_same_site session cookie) and GitLab artifacts (_gitlab_session cookies, glrt--prefixed runner tokens). AI-platform access has joined this target list: OpenAI's __Secure-next-auth.session-token cookie grants full ChatGPT web-session takeover, and Anthropic Claude Code credentials (~/.claude/.credentials.json, macOS Keychain entries, ANTHROPIC_API_KEY) are harvested for resale into an emerging illicit LLM-access market -- corroborated by the fact that privilege-escalation tooling (PEASS-ng's linPEAS/winPEAS) now ships detection rules specifically for ~/.claude credential exposure. Session-cookie theft in particular lets attackers bypass MFA entirely by replaying an already-authenticated session rather than a password.
By platform, stolen-secret volume in the analyzed dataset skews heavily toward AWS (46%), then GCP (13%), GitHub (~10%), and AI platforms (5%, predominantly OpenAI API keys), against a backdrop of 17 billion+ browser cookies stolen annually across the ecosystem and 400+ distinct non-credential secret types harvested. Initial Access Brokers curate and validate stealer logs before reselling verified, working credentials on underground marketplaces -- the gap between infection and resale ranges from hours to months. Downstream abuse of infostealer-sourced credentials has been tied to LAPSUS$ (Azure AD/Entra ID compromise), Scattered Spider (deploys Vidar and Raccoon Stealer alongside helpdesk social-engineering and SIM-swapping per the CISA/FBI joint advisory AA23-320A), and JINX-0164, a financially motivated actor (active since at least mid-2025, techniques overlapping DPRK-linked UNC1069 but not formally attributed) that combines LinkedIn recruiter-lure social engineering with custom macOS malware (the AUDIOFIX Python RAT and MINIRAT Go backdoor) to harvest Keychain, browser, SSH, and 51 different cryptocurrency-wallet-extension credentials, then uses the open-source nord-stream tool against stolen GitHub tokens to pull CI/CD secrets and inject malicious commits into victim repositories under other developers' identities.
The same infection-to-CI/CD-compromise pattern scaled into a supply-chain worm in the Miasma campaign: a Red Hat engineer's GitHub credentials and session cookie, first exposed in stealer logs on 2026-04-13 and again on 2026-05-15, were used on 2026-06-01 to publish 32 trojanized packages under the @redhat-cloud-services npm namespace, propagating via GitHub Actions OIDC-signed builds rather than a stolen npm token -- turning downstream CI pipelines that built from the poisoned packages into an additional propagation vector. Law-enforcement and industry disruption has repeatedly dented but not eliminated the ecosystem: Operation Magnus (2024-10-28) seized RedLine/MetaStealer infrastructure and led to the identification of RedLine's alleged administrator; a Microsoft/FBI-led operation (2025-05-21) seized 2,300+ Lumma C2 domains, yet Lumma had rebuilt infrastructure and resumed spreading (concentrated in India, with US/Europe activity) by February 2026; and a 2026-06 disruption of the Amadey/StealC loader network recovered 27 million stolen credentials, illustrating both the scale of the problem and its resilience to takedown.
MITRE ATT&CK techniques used in TL-2026-2687
Defense Evasion
T1027 Obfuscated Files or Information; T1497 Virtualization/Sandbox Evasion
Command and Control
Initial Access
T1078.004 Cloud Accounts; T1195.002 Compromise Software Supply Chain; T1566 Phishing
Discovery
T1082 System Information Discovery
Execution
Collection
T1213 Data from Information Repositories
Credential Access
T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1552.001 Credentials In Files; T1555.003 Credentials from Web Browsers
lateral-movement
Resource Development
Affected products and versions in The Infostealer Incursion
- GitLab Inc. — GitLab CE/EE (self-hosted)
Vulnerable versions: 16.1.0-16.1.5; 16.2.0-16.2.8; 16.3.0-16.3.6; 16.4.0-16.4.4; 16.5.0-16.5.5; 16.6.0-16.6.3; 16.7.0-16.7.1
Fixed in: 16.1.6; 16.2.9; 16.3.7; 16.4.5; 16.5.6; 16.6.4; 16.7.2 - Amazon Web Services — AWS CLI / IAM credential and SSO cache files
Vulnerable versions: N/A - local credential-file exposure, not a software version
Fixed in: N/A - Microsoft — Azure CLI / Entra ID token cache (accessTokens.json, MSAL cache)
Vulnerable versions: N/A - local credential-file exposure, not a software version
Fixed in: N/A - Google — Google Cloud SDK OAuth token stores (credentials.db, access_tokens.db)
Vulnerable versions: N/A - local credential-file exposure, not a software version
Fixed in: N/A - GitHub Inc. — GitHub.com (OAuth tokens, PATs, SSH keys, web sessions)
Vulnerable versions: N/A - session/token theft, not a software version
Fixed in: N/A - OpenAI — ChatGPT web session
Vulnerable versions: N/A - session-cookie theft, not a software version
Fixed in: N/A - Anthropic — Claude Code CLI credential store
Vulnerable versions: N/A - local credential-file/env-var exposure, not a software version
Fixed in: N/A - Red Hat / npm registry — @redhat-cloud-services npm packages
Vulnerable versions: 32 packages published under the @redhat-cloud-services namespace, 2026-06-01 (Miasma worm)
Fixed in: Malicious packages removed/unpublished by the npm registry post-disclosure
Remediation for The Infostealer Incursion
Patches
- GitLab CE/EE 16.1.6, 16.2.9, 16.3.7, 16.4.5, 16.5.6, 16.6.4, 16.7.2 and later (CVE-2023-7028)
Immediate actions
- Patch self-hosted GitLab CE/EE to 16.1.6/16.2.9/16.3.7/16.4.5/16.5.6/16.6.4/16.7.2 or later to remediate CVE-2023-7028 (CISA KEV, CVSS 10.0), the flaw Amadey has exploited to distribute StealC
- Rotate and revoke AWS (~/.aws/credentials, ~/.aws/sso/cache), Azure (accessTokens.json, MSAL token cache), and GCP (credentials.db, access_tokens.db, service-account JSON keys) credentials found on any host with a suspected infostealer infection
- Revoke and rotate GitHub OAuth tokens/PATs/SSH keys and GitLab runner tokens (glrt- prefix) exposed to a compromised developer workstation, and invalidate the corresponding session cookies (__Host-user_session_same_site, _gitlab_session)
- Rotate ANTHROPIC_API_KEY and OpenAI API keys, and invalidate ~/.claude/.credentials.json and ChatGPT __Secure-next-auth.session-token sessions on any infected host
Workarounds
- Restrict or disable the self-hosted GitLab password-reset-via-secondary-email flow on unpatched instances
- Block execution of unsigned or unexpected binaries from user Downloads/Temp directories to disrupt trojanized-installer delivery (fake Roblox.exe, Valorant SkinChanger.exe)
Longer-term hardening
- Deploy EDR/behavioral detection tuned to infostealer TTPs (bulk credential-file access, browser-data staging, sandbox-evasion API calls) rather than relying on signature AV, since modern stealers execute and exfiltrate within seconds on fully patched, actively-protected systems
- Enforce phishing-resistant MFA and device-bound/token-bound sessions to blunt session-cookie replay attacks that bypass password-plus-MFA authentication
- Monitor stealer-log and dark-web marketplaces and subscribe to breach/credential-exposure monitoring (e.g., NordStellar-class platforms) for exposure of corporate credentials
- Harden CI/CD pipelines with short-lived OIDC-based credentials over long-lived PATs/runner tokens, branch protection, and commit-signing verification to catch pipeline-based propagation as demonstrated by the Miasma npm worm
CVEs associated with The Infostealer Incursion
Weaknesses (CWE) in The Infostealer Incursion
CWE-640
Timeline of The Infostealer Incursion
- StealC infostealer first surfaces in the wild, sold as MaaS for $300/month ($1,000 for six months)
- GitLab 16.1.0 ships with the access-control flaw later tracked as CVE-2023-7028 (weak password-recovery mechanism)
- GitLab discloses CVE-2023-7028 (CVSS 10.0), an account-takeover flaw via password reset to an unverified email address
- CISA adds CVE-2023-7028 to the Known Exploited Vulnerabilities catalog following active exploitation
- Operation Magnus (US, UK, Belgium, Portugal, Australia) seizes RedLine/MetaStealer C2 servers and domains; alleged RedLine administrator Maxim Rudometov later charged
- Microsoft- and FBI-led global operation seizes and blocks 2,300+ domains forming Lumma Stealer's C2 backbone
- JINX-0164 begins targeting cryptocurrency organizations via LinkedIn recruiter-lure social engineering and custom macOS malware (Wiz tracking start, mid-2025)
- Amadey loader observed exploiting a compromised self-hosted GitLab instance (CVE-2023-7028) to distribute the StealC infostealer
- Bitdefender confirms Lumma Stealer has rebuilt its command infrastructure post-takedown and resumed spreading, concentrated in India with US/Europe activity
- A Red Hat engineer's GitHub credentials and active session cookie first appear in infostealer logs (per post-incident Whiteintel review)
- The same Red Hat engineer's GitHub credentials/session cookie reappear in stealer logs a second time
- Wiz publishes research on JINX-0164, detailing AUDIOFIX/MINIRAT malware and CI/CD-secret theft via the nord-stream tool
- Miasma worm publishes 32 trojanized packages under the @redhat-cloud-services npm namespace using the compromised engineer's credentials, propagating via GitHub Actions OIDC-signed builds
- Coordinated disruption of the Amadey/StealC loader network recovers 27 million stolen credentials; Microsoft publishes technical breakdown of both families
- Wiz Research publishes 'The Infostealer Incursion,' analyzing NordStellar exposure data across the infostealer-to-cloud/code/AI credential pipeline
Sources cited for The Infostealer Incursion
- The Infostealer Incursion: How Stolen Credentials Breach Cloud, Code, and AI Environments
- NVD - CVE-2023-7028
- CISA Known Exploited Vulnerabilities Catalog - CVE-2023-7028
- CISA Warns of Active Exploitation of Severe GitLab Password Reset Vulnerability
- Threat Actor Targets Crypto Organizations (JINX-0164)
- JINX-0164 Targets Cryptocurrency Firms with Fake Recruiter Lures and macOS Malware
- CISA and Partners Release Updated Advisory on Scattered Spider Group (AA23-320A)
- Scattered Spider, Roasted 0ktapus, Octo Tempest, Storm-0875, UNC3944 (G1015)
- NordStellar - Data Breach Monitoring
- Lumma infostealer's infrastructure seized during US, EU, Microsoft operation
- Lumma Stealer: Breaking down the delivery techniques and capabilities of a prolific infostealer
- Dutch Police Disrupt Major Info Stealers RedLine and MetaStealer in Operation Magnus
- Life on a crooked RedLine: Analyzing the infamous infostealer's backend
- Fast, Broad, and Elusive: How Vidar Stealer 2.0 Upgrades Infostealer Capabilities
- StealC and Amadey: Breaking down infostealers and the cybercrime services that deliver them
More in malware
- ClickFix Campaign Abuses Compromised Ukrainian Websites to Deploy Psychedelic Stealer
- CARBONATO Botnet Exploits Exposed Docker Daemons to Deploy AI Agent Framework, Prioritizes AI API Key Theft
- x47.c Windows Botnet-as-a-Service Weaponizes xAI Grok for AI-Assisted Persistence and AI API Credit Draining
- Sauron Loader: New DLL Side-Loading Malware-as-a-Service Deployed Against German Organizations via ClickFix, Email Bombing, and Remote-Access-Tool Vishing
- PamStealer macOS Infostealer Adds Live C2 with X25519 Key Exchange, Four-Method Persistence
Detection coverage for TL-2026-2687
As of 2026-09-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2687 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.