Academy
TermData

Credential leak

Login information such as usernames, passwords, cookies or access keys falling into the hands of unauthorized people.

Flow

  1. 1Source
  2. 2Circulation
  3. 3Use
Related families
RedLine Stealer, RisePro, Vidar
MITRE ATT&CK
T1078 · Valid Accounts
Sources
6 sources
01

Overview

Credentials leak in two main ways: when a service’s database is compromised, or when an infostealer infects the user’s device. The second gives the password in plain text together with the site it belongs to. MITRE ATT&CK

A valid credential lets the attacker get in as a legitimate user without needing to find a vulnerability. MITRE ATT&CK

02

How it works

  1. 1

    Source

    Infostealer infection, database leak or phishing page. MITRE ATT&CK

  2. 2

    Circulation

    Logs and lists are sold on markets and shared in channels. CISA and FBI (AA25-141B)

  3. 3

    Use

    Account takeover, credential stuffing or extortion. MITRE ATT&CK

03

Real-world examples

Snowflake customer environments

Snowflake customer environments were accessed using credentials stolen by infostealers; Mandiant and Snowflake notified around 165 organizations as potentially affected. Google Cloud (Mandiant)

04

How to detect it

  • Monitoring the organization’s email addresses and login addresses in log archives and leak lists. Google Cloud (Mandiant)
  • A successful login to the account from an unusual country or network. MITRE ATT&CK
05

What to do

  • Enforce multi-factor authentication on all accounts. MITRE ATT&CK
  • Change the password of the leaked account and revoke its sessions and access keys. MITRE ATT&CK
06

MITRE ATT&CK

T1078Valid AccountsT1555.003Credentials from Web BrowsersT1539Steal Web Session Cookie
07

Related families and terms

Families

RedLine StealerActiveRiseProDecliningVidarActive

Report

Infostealer Threat Report — October 2026

Terms

ULP formatCredential stuffingAccount takeoverDark web monitoring
08

Sources

  1. 1Valid Accounts (T1078) · MITRE ATT&CK
  2. 2Credentials from Web Browsers (T1555.003) · MITRE ATT&CK
  3. 3Steal Web Session Cookie (T1539) · MITRE ATT&CK
  4. 4UNC5537 targets Snowflake customer instances · Google Cloud (Mandiant), 2024
  5. 5Threat Actors Deploy LummaC2 Malware to Exfiltrate Sensitive Data from Organizations · CISA and FBI (AA25-141B), 2025-05-21
  6. 6Multi-factor Authentication (M1032) · MITRE ATT&CK
From the Essential plan

Infostealer Detection

See your firm's attack surface on one screen: how many findings, at which severity, on which domain.

View productCompare plans