Nearly half of the secrets that infostealer malware pulls off infected machines are Amazon Web Services credentials, according to new analysis from Wiz Research. The cloud security firm mapped the keys, tokens and session cookies these commodity stealers harvest, and found that a single laptop infection can end not with a stolen email password but with a foothold in a company's cloud, source code or AI accounts.
The data comes from secrets detected on infected machines through Wiz's integration with the threat intelligence service NordStellar. AWS credentials make up 46% of all compromised secrets and Google Cloud 13%. GitHub App tokens, OAuth tokens and personal access tokens account for roughly 10%, and AI platforms about 5%, led predominantly by OpenAI API keys. NordStellar identifies more than 400 distinct types of non-credential secrets being harvested.
Three stealers do most of the damage
The market behind these thefts is concentrated. Lumma C2, RedLine and Vidar account for 85.7% of all detected incidents in the dataset, which Wiz reads as a sign of how commoditized the ecosystem has become: a handful of malware-as-a-service offerings, rented for as little as a few hundred dollars a month.
Developers are a favored target. Wiz saw trojanized gaming files such as Roblox.exe and Valorant SkinChanger.exe, a sign that attackers go after developers' personal machines, which are often less protected than corporate endpoints. Around 50% of infostealer families now collect GitHub credentials, making them the fourth most targeted secret across all strains. Newer infostealer-like malware such as Miasma skips phishing entirely and goes after CI/CD pipelines and build servers through hijacked software dependencies.
Why a stolen cookie beats a stolen password
Session tokens are the shortcut around multi-factor authentication (MFA). Instead of breaking MFA, attackers take the token a service issues after a user has already logged in, load it into their own browser and act as that user, with no MFA prompt. Wiz describes this against the AWS Management Console, GitHub and GitLab web sessions, and ChatGPT, where a stolen session cookie gives the attacker the victim's chat history.
Long-lived files on disk are the other prize, and their shelf life varies by platform:
- AWS: long-term access keys in ~/.aws/credentials, plus the SSO cache, whose OIDC tokens typically last up to 90 days and can be used to keep minting fresh credentials. Short-lived STS tokens last 1 to 12 hours.
- Azure: the Azure CLI token cache, including accessTokens.json with access and refresh tokens. Wiz says Vidar 2.0 has specific logic to enumerate the .azure folder.
- Google Cloud: the gcloud credentials.db and access_tokens.db files and service account JSON keys. Google Cloud refresh tokens generally do not expire unless an administrator revokes them.
- GitLab: runner configuration files holding glrt- tokens, which Wiz says can let attackers register rogue runners and intercept CI/CD jobs.
Wiz ties this to real campaigns. The TeamPCP LiteLLM supply chain stealer listed Google's application default credentials among its exfiltration targets, and attackers exploited CVE-2023-7028 in self-hosted GitLab to spread StealC through the Amadey loader. It echoes our earlier report on stealer malware hiding in AI coding assistant folders and Anthropic's warning about infostealers draining paid Claude accounts.
Move tokens into the keychain, and log out
Many of the most valuable files are plain text only because of how tools are configured. Wiz notes that the GitHub CLI writes plaintext tokens to hosts.yml only when no system keyring is available, the GitLab CLI does so unless the --use-keyring flag is used, and tools such as Granted keep AWS credentials in the operating system's keychain rather than on disk. Running aws sso logout, or having an administrator revoke the session, closes the 90-day SSO window, while Google Cloud refresh tokens need explicit revocation.
The broader lesson is that the cloud perimeter now runs through a developer's home PC. Hardening the console does little if the token that opens it sits in a readable file on a machine that also runs game mods.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.