Stolen Logins Used Within Minutes of Infostealer Attacks

Attackers began using stolen account credentials an average of eight minutes after infostealer infections in 27 confirmed cases. The findings show why households and small offices must respond immediately when a suspicious website persuades someone to run a command or install software.

What happened

According to Help Net Security, citing research from Elastic Security Threat Command, infostealers collected information such as saved passwords, browser session data and payment details from affected computers. Captured session data can let an attacker enter an account without typing its password again.

Fake verification pages using a technique called ClickFix were the most common entry route, appearing in 12 of the 27 confirmed infostealer cases. These pages told people to copy and run a command, often claiming it was needed to verify the visitor or fix a problem. Because the victim ran the command, the attack could get around security tools focused on detecting dangerous email attachments.

Researchers also confirmed 23 cases involving abuse of remote monitoring and management software. Attackers used phishing pages or malicious script archives to install these legitimate remote-access tools. One campaign started with a fake digital invitation and secretly installed ScreenConnect as a Windows service.

The report also described attackers misusing Claude Code on Windows and the ChatGPT desktop application on macOS after gaining access. These incidents did not show a security flaw in either application or a compromise of their providers.

Who is affected

The confirmed cases came from Elastic customers, and the source did not identify affected households or disclose a complete list of organizations. However, the entry methods can reach anyone who encounters a fake verification page, fraudulent invitation or phishing message.

People who save passwords or payment information in a browser face particular concern because infostealers seek that data. Accounts may also remain exposed after a password change if an attacker has already captured a valid browser session.

What to do now

1. Never paste a command into Windows Terminal, PowerShell, Command Prompt or the macOS Terminal because a website says it is required for verification. Close the page instead.

2. If you already followed such instructions, disconnect that computer from Wi-Fi or Ethernet. Use another trusted device to change passwords for email, banking, shopping and work accounts.

3. Open each important account’s Security, Devices or Sessions page. Sign out unfamiliar devices—or choose Sign out everywhere when available—to invalidate sessions that may have been stolen.

4. Turn on multifactor authentication from the account’s Security settings. Be aware that the report documented phishing kits capable of capturing a session after a victim completed an MFA check.

5. Replace reused passwords with a different password for every account, starting with your primary email address. A password manager can store those unique credentials so they do not need to be memorized.

6. Check Settings > Apps in Windows or the Applications folder on a Mac for remote-access software you did not knowingly install. Do not remove software managed by your employer; contact its IT support instead.