Infostealers: one infected laptop, one data breach
The Snowflake customer breaches started with passwords stolen by malware, some of them years old. How to break that chain.
The data thefts from Snowflake customers this month didn’t need a clever hack. Mandiant’s report says the attackers simply logged in, using credentials stolen by infostealer malware, some of it years old, on accounts with no MFA.
An infostealer is cheap malware, often hidden in pirated software or fake game cheats. It grabs every saved password, browser cookie and session from the machine and sells them. Often the infected machine is a contractor’s laptop or a family PC used for work.
How to break the chain:
- MFA on everything, especially cloud data platforms and admin consoles. A stolen password alone then isn’t enough.
- Rotate credentials that are old or shared, and service account keys too.
- Limit where logins can come from for data platforms: your office, your VPN, your servers.
- Work accounts on work devices. Don’t let a personal laptop with pirated software hold company passwords.
- Watch for your domain in breach and stealer-log alerts. Some services offer this for free.
A password that leaked in 2020 and was never changed is still a key in 2024.