Full Report
Infostealers can expose far more than passwords, including authenticated sessions that may let attackers bypass MFA. Flare explains how defenders can prioritize compromised identities, determine whether stolen access is still usable, and respond before it leads to account takeover. [...]
Analysis Summary
# Morning News Roll-up September 3, 2026
## Overview
Today's intelligence focuses on the evolving threat of infostealer logs, which now pose a critical risk to corporate identity security. The primary concern has shifted from simple password theft to the extraction of authenticated session cookies that allow attackers to bypass Multi-Factor Authentication (MFA). Research indicates that nearly half of corporate credential exposures originate from unmanaged or personal devices, complicating the defensive response for security teams.
## Top Stories
### Your Employee’s Password Appeared in an Infostealer Log. Now What?
- Summary: Infostealer malware like Vidar, RedLine, and Lumma are increasingly harvesting session cookies alongside credentials. This allows threat actors to bypass MFA and gain immediate access to SaaS applications and identity providers. Flare reports that 90% of these logs are now distributed via Telegram, and approximately 46% of logs containing corporate credentials come from unmanaged personal devices.
- Source: hxxps://www[.]bleepingcomputer[.]com/news/security/your-employees-password-appeared-in-an-infostealer-log-now-what/
### Massive Microsoft 365 Outage Causes Auth Issues
- Summary: A significant outage has impacted Microsoft 365 services, leading to widespread authentication issues and service failures for global users.
- Source: hxxps://www[.]bleepingcomputer[.]com/news/microsoft/microsoft-exchange-online-outage-causes-email-failures-auth-issues/
### Nearly 22,000 Microsoft Exchange Servers Vulnerable to Hijack
- Summary: Security researchers have identified approximately 22,000 Microsoft Exchange servers that remain unpatched and vulnerable to remote hijack attacks, posing a severe risk for enterprise data breaches.
- Source: hxxps://www[.]bleepingcomputer[.]com/news/security/nearly-22-000-microsoft-exchange-servers-vulnerable-to-hijack-attacks/
---
# Main Topic
The exploitation of Infostealer logs to bypass Multi-Factor Authentication (MFA) via session cookie theft and unauthorized identity access.
## Key Points
- **MFA Bypass:** Infostealer logs contain browser cookies that represent "live" authenticated sessions, allowing attackers to enter corporate environments without triggering MFA prompts.
- **Unmanaged Device Risk:** Approximately 46% of corporate credential leaks originate from personal or unmanaged devices (BYOD) where corporate security policies are not enforced.
- **Growth in Exposure:** Corporate identity exposure for major SaaS and cloud services is increasing at an annual rate of 29%.
- **Telegram Dominance:** Roughly 90% of stolen logs are now traded or leaked via Telegram channels rather than traditional dark web forums.
## Threat Actors
- **Initial Access Brokers (IABs):** Use stolen logs to gain and sell access to corporate networks.
- **Ransomware Affiliates:** Purchase these credentials/sessions to deploy ransomware.
- **Opportunistic Attackers:** Leverage public Telegram leaks for quick account takeovers.
- **Malware Families:** Vidar, RedLine, and Lumma are the primary tools used for data harvesting.
## TTPs
- **Information Stealing:** Use of malware to harvest saved browser passwords, cookies, autofill data, VPN configurations, and cryptocurrency wallets.
- **Session Hijacking:** Utilizing stolen session cookies to clone a user's authenticated state.
- **Credential Stuffing/Re-use:** Exploiting corporate credentials reused on personal, infected machines.
- **Log Aggregation:** Packaging stolen data into "logs" for sale on underground markets and Telegram subscription services.
## Affected Systems
- **Identity Providers (IdP):** SSO platforms like Microsoft, Okta, etc.
- **SaaS Applications:** Productivity suites (Microsoft 365, Google Workspace).
- **Remote Access:** VPN and RDP endpoints.
- **Cloud Infrastructure:** Cloud consoles and management interfaces.
- **Operating Systems:** Primarily Windows-based personal devices infected with stealer malware.
## Mitigations
- **Session Revocation:** Immediately invalidate all active sessions for a compromised user, not just their password.
- **Device Management:** Implement strict policies for accessing corporate resources from unmanaged devices.
- **Real-time Monitoring:** Use threat intelligence services to monitor Telegram and dark web logs for corporate domains and subdomains.
- **MFA Hardening:** Transition to FIDO2/WebAuthn-based MFA which is more resistant to session hijacking than traditional methods.
- **Identity Prioritization:** Focus response efforts on compromised SSO identities and cloud console access rather than consumer-site credentials.
## Conclusion
The threat landscape has shifted from simple credential theft to full identity compromise via session hijacking. Defenders must treat an infostealer alert as a potential active breach rather than a routine password reset. The ability to monitor Telegram and underground markets in real-time is now a required capability for modern Security Operations Centers (SOCs) to prevent account takeovers before they escalate into full-scale ransomware incidents.