The Infostealer Incursion: How Stolen Credentials Breach Cloud, Code, and AI Environments
Wiz finds Lumma, RedLine, and Vidar dominate infostealer theft of AWS, GitHub, and OpenAI credentials from endpoints.
Wiz, using NordStellar telemetry, reports that infostealers remain a leading path into enterprise cloud, source-code, and AI environments. Lumma C2, RedLine, and Vidar account for 85.7% of detected incidents, and NordStellar tracks more than 400 types of non-credential secrets. AWS and GCP represent 46% and 13% of compromised secrets, GitHub tokens about 10%, and AI platform keys about 5%, mostly OpenAI API keys. Attackers also hijack session cookies to bypass MFA and, via malware such as Miasma, poison software dependencies to steal CI/CD and cloud credentials.
- Lumma, RedLine, and Vidar account for 85.7% of detected infostealer incidents.
- AWS and GCP are 46% and 13% of stolen secrets; GitHub tokens about 10%.
- AI platform keys are about 5% of secrets, led by OpenAI API keys.
- Stolen session cookies let attackers bypass MFA and reuse cloud logins.
- Miasma-like malware poisons dependencies to steal CI tokens and cloud keys.
- ATT&CK
- T1566 PhishingT1539 Steal Web Session CookieT1550.004 Web Session CookieT1552.001 Credentials In FilesT1195.001 Compromise Software Dependencies and Development Tools
- Threat actors
- JINX-0164
- Organizations
- WizNordStellarRecorded FutureVerizon
From the original article
12 min read at wiz.io
Wiz Research analyzes NordStellar data to map the credentials targeted by infostealer families and assess their potential impact across cloud, code, and AI environments.
By Gili Tikochinski · wiz.io
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.