Infostealers Expose 72% of Organizations: Why One Login Matters

A single infected employee computer can expose far more than a password. It can also give attackers access to authenticated sessions, potentially opening the door to corporate systems without another login.

Outpost24's 2026 Credential Exposure Benchmark Report found infostealer-related credential exposure at 72% of the 4,824 organizations examined across the US and Europe. The findings highlight how widely credential theft can affect businesses, even when only a small number of accounts are compromised.

Infostealers can collect saved passwords, session cookies, and authentication tokens from infected devices. For security teams, that creates a problem that password resets alone may not solve: attackers could retain access through stolen sessions unless those sessions are also revoked.

The infostealer report card for the past 12 months

Outpost24 examined 4,824 organizations across financial services, consumer goods and services, government, business services, and healthcare in the US and Europe. 

According to The Next Web, the report revealed significant differences across industries. By industry, financial services was the most affected, with 77% recording at least one infostealer-related credential. 

While that is not surprising, given the potential value of compromising companies in that industry, the fact that it sits at the top of this report is still concerning because almost everyone uses financial services, and a financial breach can affect a potentially large pool of victims.

Consumer goods and services companies, meanwhile, recorded 498 exposed credentials, almost all associated with customer accounts.

Geographical differences were also apparent. Enterprises in Europe had an average of 224 exposed credentials, 22% higher than the 184 recorded among their US counterparts.

The findings suggest that credential exposure is widespread, although the number of exposed accounts does not necessarily indicate whether attackers successfully accessed corporate systems.

Infostealers extend beyond just passwords

Infostealers are often understood as malware that steals saved passwords, but their targets extend beyond login details. Attackers increasingly target session cookies and authentication tokens because, unlike a stolen password, a valid session cookie may let them impersonate an already authenticated user without entering credentials again.

That is particularly concerning for organizations that rely on multi-factor authentication (MFA). Although MFA adds another layer of protection during login, attackers can bypass it if they skip the password and steal authentication tokens.

That makes session security, endpoint protection, and the ability to revoke compromised sessions important parts of an organization's response to infostealer infections.

Stolen credentials have a risky numbers problem

At first glance, the numbers in Outpost24's report might suggest that infostealer malware accounts for only a small part of the credential exposure problem — just 844,000 of the 31.5 million credentials examined, or less than 3%. 

However, that small percentage hides a potentially much bigger problem: a single compromised employee account could give attackers a foothold inside an organization, with opportunities to access other systems and resources depending on the account's permissions.

The October 2026 incident involving Meta offers a fresh example. Attackers reportedly used an employee’s stolen credentials to access some of the company's GitHub repositories. 

The incident illustrates why the number of compromised credentials alone is a poor measure of potential business impact. One employee account with access to sensitive development resources can present a more serious internal security risk than hundreds of exposed customer logins.

The problem is not isolated to Meta. Several cyberattacks that have made headlines have been linked to employee machine compromises, which exposed additional information. Top-level business executives and developers have been one of the industry's documented targets in these kinds of attacks because of the level of access their accounts hold.

The underlying problem is that employee devices often provide access to multiple business services, from corporate email and cloud platforms to development environments and internal applications. 

This makes even a single infostealer infection worth investigating as a possible starting point for a wider compromise, rather than treating it as an isolated password leak.

What this report means for defenders

The Outpost24 findings reinforce why organizations must look beyond password resets when responding to infostealer infections. MFA remains an important defense, but it should be supported by endpoint protection, session security, and access controls.

Organizations should deploy endpoint detection and response (EDR), enable tamper protection to prevent attackers from turning off security tools, and monitor devices for suspicious activity.

Browsers also require attention because they store passwords, session cookies, and other authentication data that infostealers target. Google's Device Bound Session Credentials (DBSC), introduced in Chrome 146 for Windows and 148 for Macs, offers additional protection by making stolen session cookies harder to reuse on other devices.

Organizations should also enforce least-privilege access, restrict unnecessary administrative permissions, monitor lateral movement, and review unusual login activity. 

The Outpost24 findings highlight why organizations should treat infostealer infections as more than isolated password theft. Security teams need to determine what information was exposed, whether active sessions were compromised, and which business systems an affected account could access.

Password resets, endpoint remediation, session revocation, and least-privilege access controls can help contain the damage. The goal is not simply to reduce the number of stolen credentials, but to prevent a single compromised account from becoming an entry point into the wider organization.

In other news, Google has released Chrome 157 with fixes for 213 security vulnerabilities, including seven critical flaws, prompting users and IT administrators to update their browsers to reduce potential security risks.