The Infostealer Incursion: How Stolen Credentials Breach Cloud, Code, and AI Environments

This report documents the rise and mechanics of infostealer malware as a dominant initial-access vector for cloud and development environments, detailing how commodity MaaS families (e.g., Lumma, RedLine, Vidar) and supply-chain‑style infostealers harvest API keys, session tokens, and credentials from developer endpoints, CI/CD systems, and AI tooling to bypass MFA, hijack sessions, and gain persistent programmatic access to AWS, Azure, GCP, GitHub/GitLab, and OpenAI/Anthropic resources; it enumerates specific files, token caches, environment variables, and browser cookies targeted and highlights operational impact and detection/remediation considerations.