While ransomware dominates cybersecurity headlines, many large corporate breaches are now traced to a quieter accomplice: the infostealer. Long before data is encrypted or a ransom note appears, an infostealer has often slipped past defenses, harvested saved passwords and other browser data, and vanished.
Constella Intelligence’s Q2 2026 Quarterly Identity Breach Report examines how exposed credentials, sessions, browser data, and devices are circulating across criminal ecosystems. It found a 99.53% surge in infostealer incidents over Q1. The report also notes that Constella’s data lake closed the quarter with 72.95 billion records, up 14.07% from Q1.
An infostealer (information stealer) is a type of malicious software designed to quietly harvest sensitive data from an infected computer or browser and send it to an attacker. Unlike ransomware, which locks files and demands money, infostealers run silently in the background to avoid detection.
This creates an important visibility challenge for security teams. An organization may have strong controls around its corporate network and managed endpoints, while an employee’s identity is exposed through an infection on a personal or otherwise unmanaged device.
The danger lies in the fact that while the organization may never have seen the original infection, it can still face the consequences of the stolen identity data.
The Risk Can Extend Beyond the Initial Login
Infostealers go beyond compromising usernames and passwords. They can also capture browser cookies, session tokens, browsing data, cached credentials, and device information.
This is significant because authentication does not always begin again with a username and password. If a stolen authenticated session remains valid, an attacker may potentially reuse it without completing the normal login process again. The effectiveness of this type of attack depends on factors such as token validity, platform controls, and whether compromised sessions are detected and revoked.
This is one reason organizations need to look beyond traditional credential monitoring and understand the broader context surrounding an exposed identity.
External Identity Exposure Requires Broader Visibility from Organizations
Constella’s Quarterly Identity Breach Report shows how significant external exposure has become.
The Constella Data Lake closed Q2 with 72.95 billion records, an increase of 14.07% from Q1. Email addresses appeared in 51.07% of curated Hacked Leaked and Combo records, while plaintext passwords appeared in 50.90%.
The challenge for security teams is connecting these individual signals.
A password may indicate compromised access. An email address provides an identity anchor. URLs can reveal services associated with the victim. Device information and other attributes can add further context.
Viewed individually, each is a data point. When viewed as a connected entity they can provide a much clearer picture of what an attacker may know about an identity.
The findings reinforce the need for organizations to expand identity risk management beyond internal systems and take a more comprehensive approach to external exposure. This includes correlating exposure across identities, treating confirmed plaintext credentials as immediately actionable, investigating infostealer infections beyond password resets, reviewing active sessions and authentication artifacts where supported, strengthening authentication controls, and continuously monitoring external identity exposure.
Stay Updated on the Latest Identity Threat Data
Infostealer malware can expose far more than passwords. Stolen browser data, session cookies, and other authentication information can give cybercriminals opportunities to access accounts and exploit compromised identities. And because stolen information can circulate through criminal marketplaces long after the initial infection, identifying exposure early is an important part of reducing the risk.
White-label identity protection gives businesses a way to help customers address these evolving threats without building their own identity protection infrastructure. Through services such as dark web monitoring, compromised credential detection, and identity restoration, organizations can offer branded protection that helps individuals identify potential exposure and take appropriate action.
Enfortra’s Threat Signal Fusion capabilities help connect identity threat signals across breach data, infostealer logs, botnet exposures, and other sources. Additional capabilities, including password exposure checks and account takeover detection, can help organizations identify compromised credentials and reduce the risk of unauthorized access. When identity theft occurs, managed identity restoration provides additional support to help affected individuals navigate the recovery process.
By combining proactive monitoring with actionable alerts and recovery assistance, organizations can extend their identity protection offerings beyond basic breach notifications and provide customers with a more comprehensive response to identity threats.
For additional research on breach activity, infostealers, and exposed identity data, see Constella Intelligence’s Q2 2026 Quarterly Identity Breach Report.
