# The Infostealer Incursion: Stolen Credentials Breach Cloud, Code, and AI Environments

> Wiz Research analysis of NordStellar credential-exposure data shows an industrialized infostealer ecosystem (Lumma, RedLine, Vidar, StealC, Amadey, Miasma, Ghost Loader) accounting for the majority of harvested credentials, with Lumma+RedLine+Vidar alone representing 85.7% of observed theft. Stolen browser sessions, OAuth tokens, and local credential files now routinely grant attackers access to AWS, Azure/Entra ID, GCP, GitHub/GitLab CI/CD, and AI platforms including OpenAI ChatGPT and Anthropic Claude Code.

- **Published:** 2026-09-27T00:00:00Z
- **Last reviewed:** 2026-09-27T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2687
- **ID:** TL-2026-2687
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Infostealer operators & Initial Access Brokers
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2023-7028

## Description

Wiz Research's 'Infostealer Incursion' report (2026-09-25) analyzes credential-exposure telemetry from NordStellar's threat-exposure-management platform to show that commodity infostealer malware has become the primary initial-access vector into cloud, source-control, and AI environments. Three families -- Lumma (LummaC2), RedLine, and Vidar -- account for 85.7% of detected infostealer incidents and are rented on Malware-as-a-Service (MaaS) platforms for as little as a few hundred dollars a month, alongside StealC, Amadey, Miasma, and Ghost Loader. Distribution relies on trojanized gaming installers (fake Roblox.exe, 'Valorant SkinChanger.exe'), abuse of legitimate signed Windows binaries (vbc.exe), and, notably, exploitation of the maximum-severity GitLab authentication-bypass flaw CVE-2023-7028 (CVSS 10.0, CISA KEV) by the Amadey loader to distribute StealC via a compromised self-hosted GitLab instance.

Once resident on a host, these stealers systematically target cloud CLI credential stores rather than just browser passwords: AWS's plaintext ~/.aws/credentials and ~/.aws/sso/cache (OIDC tokens valid up to 90 days); Azure's .azure/accessTokens.json and MSAL token cache, with Vidar 2.0 adding dedicated enumeration of %USERPROFILE%\.azure and the azureProfile.json subscription/tenant manifest; and GCP's credentials.db/access_tokens.db OAuth refresh-token stores and $GOOGLE_APPLICATION_CREDENTIALS service-account keys. Roughly half of tracked infostealer families now actively collect GitHub credentials (OAuth tokens, PATs, SSH keys, and the __Host-user_session_same_site session cookie) and GitLab artifacts (_gitlab_session cookies, glrt--prefixed runner tokens). AI-platform access has joined this target list: OpenAI's __Secure-next-auth.session-token cookie grants full ChatGPT web-session takeover, and Anthropic Claude Code credentials (~/.claude/.credentials.json, macOS Keychain entries, ANTHROPIC_API_KEY) are harvested for resale into an emerging illicit LLM-access market -- corroborated by the fact that privilege-escalation tooling (PEASS-ng's linPEAS/winPEAS) now ships detection rules specifically for ~/.claude credential exposure. Session-cookie theft in particular lets attackers bypass MFA entirely by replaying an already-authenticated session rather than a password.

By platform, stolen-secret volume in the analyzed dataset skews heavily toward AWS (46%), then GCP (13%), GitHub (~10%), and AI platforms (5%, predominantly OpenAI API keys), against a backdrop of 17 billion+ browser cookies stolen annually across the ecosystem and 400+ distinct non-credential secret types harvested. Initial Access Brokers curate and validate stealer logs before reselling verified, working credentials on underground marketplaces -- the gap between infection and resale ranges from hours to months. Downstream abuse of infostealer-sourced credentials has been tied to LAPSUS$ (Azure AD/Entra ID compromise), Scattered Spider (deploys Vidar and Raccoon Stealer alongside helpdesk social-engineering and SIM-swapping per the CISA/FBI joint advisory AA23-320A), and JINX-0164, a financially motivated actor (active since at least mid-2025, techniques overlapping DPRK-linked UNC1069 but not formally attributed) that combines LinkedIn recruiter-lure social engineering with custom macOS malware (the AUDIOFIX Python RAT and MINIRAT Go backdoor) to harvest Keychain, browser, SSH, and 51 different cryptocurrency-wallet-extension credentials, then uses the open-source nord-stream tool against stolen GitHub tokens to pull CI/CD secrets and inject malicious commits into victim repositories under other developers' identities.

The same infection-to-CI/CD-compromise pattern scaled into a supply-chain worm in the Miasma campaign: a Red Hat engineer's GitHub credentials and session cookie, first exposed in stealer logs on 2026-04-13 and again on 2026-05-15, were used on 2026-06-01 to publish 32 trojanized packages under the @redhat-cloud-services npm namespace, propagating via GitHub Actions OIDC-signed builds rather than a stolen npm token -- turning downstream CI pipelines that built from the poisoned packages into an additional propagation vector. Law-enforcement and industry disruption has repeatedly dented but not eliminated the ecosystem: Operation Magnus (2024-10-28) seized RedLine/MetaStealer infrastructure and led to the identification of RedLine's alleged administrator; a Microsoft/FBI-led operation (2025-05-21) seized 2,300+ Lumma C2 domains, yet Lumma had rebuilt infrastructure and resumed spreading (concentrated in India, with US/Europe activity) by February 2026; and a 2026-06 disruption of the Amadey/StealC loader network recovered 27 million stolen credentials, illustrating both the scale of the problem and its resilience to takedown.

## MITRE ATT&CK

- T1584.001 Domains
- T1608.001 Upload Malware
- T1566 Phishing
- T1195.002 Compromise Software Supply Chain
- T1078.004 Cloud Accounts
- T1204.002 Malicious File
- T1027 Obfuscated Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1550.004 Web Session Cookie
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1528 Steal Application Access Token
- T1552.001 Credentials In Files
- T1082 System Information Discovery
- T1213 Data from Information Repositories
- T1071.001 Web Protocols

## Sources

- [The Infostealer Incursion: How Stolen Credentials Breach Cloud, Code, and AI Environments](https://www.wiz.io/blog/infostealer-incursion-cloud-ai-credentials)
- [NVD - CVE-2023-7028](https://nvd.nist.gov/vuln/detail/cve-2023-7028)
- [CISA Known Exploited Vulnerabilities Catalog - CVE-2023-7028](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-7028)
- [CISA Warns of Active Exploitation of Severe GitLab Password Reset Vulnerability](https://thehackernews.com/2024/05/cisa-warns-of-active-exploitation-of.html)
- [Threat Actor Targets Crypto Organizations (JINX-0164)](https://www.wiz.io/blog/threat-actors-target-crypto-orgs)
- [JINX-0164 Targets Cryptocurrency Firms with Fake Recruiter Lures and macOS Malware](https://thehackernews.com/2026/05/jinx-0164-targets-cryptocurrency-firms.html)
- [CISA and Partners Release Updated Advisory on Scattered Spider Group (AA23-320A)](https://www.cisa.gov/news-events/alerts/2025/07/29/cisa-and-partners-release-updated-advisory-scattered-spider-group)
- [Scattered Spider, Roasted 0ktapus, Octo Tempest, Storm-0875, UNC3944 (G1015)](https://attack.mitre.org/groups/G1015/)
- [NordStellar - Data Breach Monitoring](https://nordstellar.com/data-breach-monitoring/)
- [Lumma infostealer's infrastructure seized during US, EU, Microsoft operation](https://therecord.media/lumma-infostealer-malware-takedown-microsoft-fbi)
- [Lumma Stealer: Breaking down the delivery techniques and capabilities of a prolific infostealer](https://www.microsoft.com/en-us/security/blog/2025/05/21/lumma-stealer-breaking-down-the-delivery-techniques-and-capabilities-of-a-prolific-infostealer/)
- [Dutch Police Disrupt Major Info Stealers RedLine and MetaStealer in Operation Magnus](https://thehackernews.com/2024/10/dutch-police-disrupt-major-info.html)
- [Life on a crooked RedLine: Analyzing the infamous infostealer's backend](https://www.welivesecurity.com/en/eset-research/life-crooked-redline-analyzing-infamous-infostealers-backend/)
- [Fast, Broad, and Elusive: How Vidar Stealer 2.0 Upgrades Infostealer Capabilities](https://www.trendmicro.com/en_us/research/25/j/how-vidar-stealer-2-upgrades-infostealer-capabilities.html)
- [StealC and Amadey: Breaking down infostealers and the cybercrime services that deliver them](https://www.microsoft.com/en-us/security/blog/2026/06/24/stealc-and-amadey-breaking-down-infostealers-and-the-cybercrime-services-that-deliver-them/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2687