The Infostealer Incursion: How Stolen Credentials Breach Cloud, Code, and AI Environments

Identity has long been the primary attack surface of the cloud. Infostealer malware, distributed through an industrialized cybercrime economy, is a leading initial access vector for compromising enterprise cloud, code, and AI environments. By targeting unsecured endpoints of developers through social engineering and supply chain attacks, threat actors steal credentials, API keys, and active session tokens, thereby bypassing the stronger defenses protecting most cloud environments from more direct attacks. Stolen credentials are widely recognized as one of the most common initial infection vectors - Microsoft, Recorded Future, and Verizon’s DBIR all point to infostealers as a cause of major concern. These attacks begin with a simple malware infection on a personal device, and end with attackers gaining privileged access to your AWS, Azure, or GCP estate, and more recently to the code platforms used by your organization, such as GitHub or GitLab. Understanding how this happens is the first step to building a resilient defense. We therefore set out to map each of the various cloud keys targeted by infostealer malware and determine the value threat actors can derive from them. What are InfoStealers, and what secrets do they steal? Modern infostealer attacks are the product of a mature, multi-layered…