The Password That Was Already Gone (Twelve Ways In, Part 2)

Most intrusions do not begin with a break-in. They begin with a login that succeeds.

The password is real. The account is real. The session is granted by the real identity provider, to a real user name, on a request that passes every check the platform offers. Nothing is exploited. Somebody on the other end simply has the credential, and has had it for a while.

This is part two of Twelve Ways In, a series on the twelve routes attackers most often use against a small or mid-size business, one per installment, each followed by the controls that close it. Part one covered an attacker standing in front of a login page. This one covers an attacker holding a copy of the key and walking in through the front door during business hours. It is the cheapest initial access in the world right now, and the most common reason an incident responder finds no malware on the network at all.

The mechanics, in order

Step one is a download that looks reasonable. A cracked copy of an application. A driver from a search ad. A game mod, a browser extension, an installer someone was told to run by a pop-up. The delivery does not have to be clever, because the target is not the company. It is a person, on a machine the company never sees.

Step two is the harvest. An infostealer is a small, focused piece of software with an unusually boring job description: read what the browser has saved, and send it out. Saved passwords, autofill records, payment cards, session cookies, crypto wallet files, FTP and VPN client credentials, the contents of a handful of configuration folders. It runs for a few minutes, sends its package to a server, and often removes itself. On the machine it leaves very little to find.

Step three is packaging and sale. The output is what the criminal economy calls a log: a per-machine bundle of credentials, cookies and system details, sold in bulk or by subscription on markets and in messaging channels. Prices are low enough that buyers do not need a target in mind. They buy volume, then filter it for the domain they want.

Step four is the part defenders underestimate. Somebody types your domain into a search box and gets back a list of your staff, the passwords their browsers saved for your mail, your VPN and your intranet, and valid session cookies where the user had not signed out. The research firm Breachsense counted 326,444 infected machines in the stealer logs it indexed during October 2026, holding 74.3 million credential records and just under 30 million distinct username and password pairs. That is one month.

Step five is a sign-in. Usually from a residential address or a cheap cloud host, at whatever hour suits the operator, with a valid password and an MFA challenge that either does not exist on that particular entry point or is satisfied by a stolen cookie.

Why the password outlives the infection

A password is not a perishable good. Nothing about it decays when the laptop it was saved on gets cleaned, handed to a repair shop or thrown away. Unless a human decides to change it, it keeps working. And the human has no reason to change it, because from their side nothing happened. The machine ran a little slowly for ten minutes one evening.

Reuse is the multiplier. Most people have a personal account somewhere with a password they also use for work, or a work password they have used since a previous job. The October 2026 stealer data is blunt about the overlap: 47,655 of those infected machines had a Microsoft 365 password saved, and 29,175 had an OpenAI credential. Those are not company laptops. Companies rename their machines. Two thirds of the infected machines that recorded a device name still had Windows' factory default name, which is a decent indicator that IT never touched them.

The median infected machine gave up 21 saved logins. A quarter of them gave up 65 or more, and one in ten gave up at least 142. A single person with a bad habit of saving everything in one browser profile can hand over the keys to most of a small company's SaaS estate at once.

Cookies make it worse. A saved password can be defeated by a second factor. A live session cookie cannot, because the second factor already happened. Recorded Future, reviewing 2025 data, found 276 million of the credentials it indexed included active session cookies, roughly 31 percent of all malware-sourced credentials. Of the credentials with an identifiable sign-in URL, 63 percent pointed at authentication systems: identity providers, VPN portals, single sign-on. The logs are not a random sample of the internet. They are sorted for exactly the doors that matter.

Eight minutes

Elastic's Security Threat Command unit published a quarterly report on November 4, 2026, drawn from confirmed customer intrusions between April and September. Across 27 confirmed infostealer cases, the average time between the infection and the attacker logging in with the same credentials was eight minutes. Not eight days. Eight minutes.

That number should change how a business thinks about its own response speed, because it removes the assumption that there is a window to work in. The traditional model is: something gets infected, IT eventually notices, IT reimages the machine and resets the password. Eight minutes means the login is already done before anyone could plausibly have noticed. The reset arrives after the session exists.

It also explains a pattern that confuses people during response. There is no malware on the corporate network. Endpoint protection has nothing to quarantine because the endpoint was never yours. The firewall logs show an outbound connection to your own mail provider. The only artifact is a successful authentication, and successful authentications are what the logs are mostly made of.

Recorded Future's timing data points the same direction from the other end. Of the credentials it indexed in 2025, 36.4 percent were visible within 24 hours of being stolen, and 53 percent within a week. This is a fast, working market with fast, working buyers, not a warehouse of old dumps.

What it looks like from the owner's chair

You will rarely see the login. You will see what it produces, and it usually arrives as an ordinary business request.

A supplier emails to confirm a change of bank details. An invoice arrives with new payment instructions and a domain that is very nearly right. A finance manager gets a short, urgent, confidential request from the managing director's real mailbox, sent from a real session on a real account. A client receives a quote from your company with a different account number on it.

On the IT side the tells are quieter and easier to miss. A sign-in from a city nobody on staff has visited, with MFA satisfied. A device that is joined to the tenant but is not in the asset inventory. An inbox rule forwarding mail to an outside address, usually named something dull enough to scroll past. A VPN session from an unusual network at 3 AM. A password reset that happened recently but a session that refuses to die.

The uncomfortable detail is that all of these look almost exactly like a legitimate remote worker on hotel Wi-Fi. Deciding which one is which is a judgment call made on incomplete data, at speed, which is precisely why the controls below lean on conditions rather than vigilance.

The controls that close it

Start with the one that changes the economics: a compliant-device requirement on every sign-in to mail, file storage and admin portals. Conditional Access in Microsoft Entra, or the equivalent in Google Workspace, can require that the device be managed and healthy before a token is issued. A stolen cookie replayed from a personal laptop or a rented server fails that condition. The credential is still valid. The door still does not open. This is the control that turns an eight minute compromise into a support ticket.

Second, MFA on everything, including the entry points people forget. VPN concentrators, webmail, the old intranet, the finance application nobody has looked at since the last audit. Credential abuse was the first initial access vector in 13 percent of breaches in the Verizon 2026 DBIR, but it appears somewhere in the chain in 39 percent of them, which is the number that matters. A control that covers most of the estate is not a control.

Third, find out what is already for sale. Breached-credential screening at sign-in, and stealer-log monitoring against your own domains, are cheap and unglamorous and they surface the problem before a buyer does. Recorded Future's own reporting makes the case: over half of credentials are visible within a week, so a weekly check is not fast, it is barely adequate. Daily is better.

Fourth, kill reuse at the source and stop saving work credentials in personal browsers. A password manager gives people a reason not to reuse, which is the only durable fix. A policy that forbids saving corporate logins in a personal Chrome profile does the rest of the work.

Fifth, fix the response playbook. A password reset does not evict an intruder holding a live session. Revoke sessions and refresh tokens, remove rogue authentication methods, remove enrolled devices, then reset. Reverse the order and you have changed the lock on a door that is already open.

Sixth, alert on the cheap signals. Sign-in from a new country or a new network for a user who has never travelled. Many users, one password, in a short window. A mailbox rule pointing outside the tenant. A new device registration. None of these is a verdict. Each is a question worth asking within the hour rather than the week.

The takeaway

This path needs no vulnerability, no zero-day and no especially skilled operator. It needs a person who saved a work password on a home machine, and a market that will sell it to whoever asks first. Information stealing malware is sold as a service, the logs are indexed and searchable, and the buyers are patient.

The defense follows from that. Assume some of your credentials are already for sale, because statistically some are, and make holding the password insufficient on its own. Device conditionality and phishing-resistant authentication do that. Everything else is detection, and detection at eight minutes is not a control. It is a post-mortem.

Part three of this series covers the opposite approach: no stolen password at all, just one guess against every account you own, slowly enough that nobody notices.

Sources

• Elastic Security Labs, 'When trust becomes the payload: threats, etc quarterly report', November 4, 2026 (average of eight minutes from infostealer infection to credential login, 27 confirmed cases): https://www.elastic.co/security-labs/reports/threats-etc-report-november-2026-trouble-with-trust
• Help Net Security, 'An average of 8 minutes is all hackers need to log in with stolen credentials', November 9, 2026: https://www.helpnetsecurity.com/2026/11/09/elastic-businesses-remote-access-attacks-report/
• Breachsense, 'October 2026 Infostealer Report: Default Device Names' (326,444 infected machines, 74,316,771 credential records, 29,983,953 distinct pairs, 21/65/142 saved credentials per machine, 47,655 Microsoft 365 and 29,175 OpenAI credentials), last updated November 1, 2026: https://www.breachsense.com/infostealer-reports/october-2026/
• Recorded Future, 'Inside the Infostealer Economy: Credential Threats in 2025' (87 credentials per compromised device, 276 million cookie-bearing credentials at 31 percent, 63.2 percent tied to authentication systems, 36.4 percent indexed within 24 hours): https://www.recordedfuture.com/blog/identity-trend-report-march-blog
• Verizon, 2026 Data Breach Investigations Report (vulnerability exploitation at 31 percent of breaches as first vector; credential abuse at 13 percent as first vector and present in 39 percent overall): https://www.verizon.com/business/resources/reports/dbir/
• Microsoft Threat Intelligence, 'StealC and Amadey: Breaking down infostealers and the cybercrime services that deliver them', June 24, 2026 (infostealer as a service, 200+ command-and-control domains disrupted with Europol): https://www.microsoft.com/en-us/security/blog/2026/06/24/stealc-and-amadey-breaking-down-infostealers-and-the-cybercrime-services-that-deliver-them/