In the anatomy of a modern ransomware attack the encryption event that triggers the incident response is rarely the beginning of the story. By the time a ransomware operator deploys their payload the affected organisation has typically already been compromised for weeks or months. Understanding what happened before the encryption is the key to understanding why so many ransomware attacks succeed against organisations with mature security programmes.

The answer, in a large and growing percentage of cases, is infostealer malware.

What an Infostealer Actually Does

An infostealer is a category of malware designed to silently harvest credentials, session tokens, browser-saved passwords, cryptocurrency wallets and authentication cookies from an infected device. It typically runs for a few minutes, extracts everything it can find and then transmits the data to a command and control server before deleting itself. The entire process often leaves no persistent trace on the device.

The most widely deployed infostealers in 2025 and 2026 include Redline, Raccoon, Vidar and Lumma. All four are available as a service on criminal forums for monthly subscription fees ranging from $100 to $300. A threat actor does not need technical skills to deploy them. They purchase access, receive a dashboard and start receiving stolen credential packages within hours.

The critical detail that most security teams miss is where these infections occur. Infostealers predominantly land on personal devices that employees use for work activities: home computers that have corporate applications installed, personal laptops used to access company email and family computers where a spouse or child has downloaded cracked software containing the malware. None of these devices run corporate endpoint detection agents.

The Credential-to-Ransomware Pipeline

The path from an infostealer infection to a ransomware deployment follows a consistent commercial chain that threat intelligence researchers have now documented extensively.

A threat actor operating the infostealer sells harvested credential logs on a criminal marketplace. The logs are sorted and searchable by employer domain, application type and credential freshness. A ransomware affiliate purchases logs matching their target organisation’s domain, identifies valid VPN credentials or cloud SSO tokens and uses them to authenticate as a legitimate employee. Because the credentials are real and the authentication looks normal, most security tools do not raise an alert.

From that initial access point the affiliate moves laterally, escalates privileges and stages the ransomware deployment. The entire process from credential purchase to ransomware execution can take as little as 48 hours.

Infostealer-Linked Ransomware Incidents by Sector

Industry Sector	Total Ransomware Incidents	Infostealer as Initial Access	Percentage
Healthcare	312	198	63%
Financial Services	287	176	61%
Manufacturing	401	267	67%
Education	218	152	70%
Legal and Professional Services	194	134	69%
Retail	276	166	60%
Technology	341	231	68%
Government	189	118	62%

Table 1: Infostealer as initial access vector in ransomware incidents by sector, Jan 2025 to Mar 2026 (Source: Aggregated threat intelligence, five major vendors)

Why Traditional Defences Do Not See This Coming

The fundamental problem is a visibility gap. Corporate security tools monitor corporate devices on corporate networks. An infostealer running on an employee’s home computer is completely outside that perimeter. The first indication most security teams have that their credentials are circulating on criminal markets is when they see an authentication from an unusual location or a threat intelligence vendor sends an alert.

Some organisations have addressed this by deploying browser-based enterprise extensions that enforce corporate authentication policies on personal devices. Others have moved entirely to hardware security keys that cannot be replicated by a stolen session token. Both approaches significantly reduce the attack surface but neither eliminates it entirely.

The most practical immediate step for most organisations is to subscribe to a credential monitoring service that watches criminal marketplaces for their domain and alerts the security team when employee credentials appear. This does not prevent the infection but it can compress the window between credential theft and credential use from weeks to hours.

The Role of Session Token Theft

Beyond passwords, modern infostealers specifically target authenticated session cookies. A valid session cookie allows an attacker to bypass authentication entirely because the session has already been established. Multi-factor authentication does not help here. The session was authenticated legitimately. The attacker is simply continuing it from a different device.

This technique, known as pass-the-cookie, has been documented in attacks against Google Workspace, Microsoft 365 and Okta environments. Okta confirmed in late 2023 that a session token stolen by an infostealer was used to access their support case management system. The threat actor did not crack a password or defeat MFA. They presented a valid cookie that a real employee had generated.

The defence against pass-the-cookie attacks is continuous session validation that checks device fingerprint, IP reputation and behavioural signals throughout a session rather than only at the point of authentication. This capability exists in enterprise identity platforms but is not enabled by default in most deployments.