- Join Our Company
- Email: sanjay@pjnetworks.com
- Phone: +91-9818361787
In the first half of 2026, threat intelligence teams across the globe have flagged a single attack pattern above all others: credential theft via infostealer malware. Infostealers—lightweight, commercially distributed malware families such as Lumma, Vidar, and Stealc—quietly harvest browser-saved passwords, session cookies, SSH keys, VPN credentials, and cryptocurrency wallet files before exfiltrating them to command-and-control infrastructure operated by Initial Access Brokers (IABs). Those brokers then sell authenticated sessions on darknet markets, giving ransomware gangs and espionage actors a ready-made foothold inside victim organisations—without a single brute-force attempt or phishing email that triggers a gateway alert.
For Indian enterprises, the exposure is acute. A growing number of employees use corporate devices for personal browsing, accept browser extensions from unofficial sources, and work from home over insufficiently secured endpoints. Meanwhile, India’s rapid SaaS adoption means that a single stolen browser session can grant lateral access across cloud-hosted ERP, HRMS, and business-intelligence platforms—entirely bypassing the on-premises perimeter firewall that most security budgets were built around.
This guide explains how infostealers work, why they are difficult to detect with traditional controls, and what a layered defence—spanning endpoint, network, identity, and operations—looks like for an Indian enterprise in 2026.
Modern infostealer campaigns rarely rely on macro-laden Office documents or phishing URLs that trip up email gateways. The most effective distribution vectors today include:
pip install or npm install.Once on the endpoint, a modern infostealer runs entirely in memory where possible, completes its harvest in under 60 seconds, and uploads a compressed archive of stolen data before most EDR signatures trigger. The dwell time is measured in minutes, not days.
The typical infostealer payload targets:
~/.ssh/*password*, *secret*, *.kdbx from the Desktop and Documents foldersAfter purchase on a darknet marketplace, an attacker with a stolen session cookie bypasses multi-factor authentication entirely—the MFA challenge was already answered by the legitimate user hours earlier, and the cookie is still valid. The attacker moves to the cloud tenant, enumerates mailboxes, establishes forwarding rules, and begins a Business Email Compromise sequence or deploys a second-stage ransomware loader onto a cloud-connected on-premises system—all within a single authenticated session that your SIEM may never flag as anomalous because the source IP and browser fingerprint look like a plausible employee.
Most Indian enterprise networks are protected by a next-generation firewall at the perimeter—typically a FortiGate—supplemented by email filtering and an antivirus agent on endpoints. This architecture excels at blocking known-bad network traffic, C2 callbacks to blocklisted domains, and file-based threats with AV signatures. It struggles against infostealers for several structural reasons:
A FortiGate NGFW with SSL deep inspection enabled can decrypt and re-inspect outbound HTTPS traffic, revealing infostealer C2 callbacks and exfiltration attempts hidden inside TLS tunnels. Key configuration steps include:
These controls reduce the probability that an infostealer payload is delivered and executed in the first place—but they must be combined with detection controls, because determined threat actors will find gaps.
ZTNA architecture changes the authentication model from “trust the session once the user logs in” to “re-verify the device and user identity before every resource access.” When properly implemented, a ZTNA solution can validate:
A stolen session cookie from an unmanaged endpoint fails the device-posture check. An attacker using a stolen VPN credential from a datacenter IP in Eastern Europe fails the network-context check. ZTNA does not eliminate infostealer risk, but it substantially raises the cost of converting a stolen credential into authenticated access to corporate resources.
For employees working from personally owned devices, the enterprise should consider a lightweight managed-EDR offering—either through a BYOD enrolment policy or through a secured virtual workspace (VDI/DaaS) that keeps corporate credentials entirely off the unmanaged endpoint. The critical principle: a corporate password should never be typed into or stored on an unmanaged device.
Even with strong preventive controls, some credentials will be stolen. A threat intelligence capability that monitors darknet markets, Telegram channels used by IABs, and paste sites for mentions of your organisation’s domains and email addresses gives you early warning before a stolen credential is used. When an alert fires, the response is: force-password-reset for the affected account, revoke all active sessions, check audit logs for the past 30 days, and escalate to the SOC for investigation.
Preventing every infostealer infection is not realistic. What is realistic is detecting the indicators that follow an infection—anomalous login locations, impossible-travel alerts, unusual data-access patterns—and responding before the attacker can pivot. This is the problem that the PrahiX Ora unified SecOps platform is designed to solve. PJ Networks deploys and operates Ora for clients across India, integrating it with their existing FortiGate, EDR, and cloud environments.
SIEM — Detect the Impossible Login: Ora’s SIEM ingests authentication logs from Microsoft 365, Google Workspace, FortiGate, VPN gateways, and on-premises Active Directory. Correlation rules mapped to the MITRE ATT&CK framework—specifically Technique T1539 (Steal Web Session Cookie) and T1606 (Forge Web Credentials)—fire when a session originates from a geography inconsistent with the user’s prior access history, or when two concurrent sessions for the same account arrive from different across India. The graph-based attack storyline reconstruction links the anomalous login to the originating endpoint event, giving analysts the full chain rather than isolated alerts. Tiered retention (hot/cold/archive) ensures log data is available for the 180-day period specified in CERT-In’s direction on log retention—a compliance requirement that many organisations still struggle to meet on-premises.
NMS — Monitor the Endpoint Traffic That Bypasses EDR: In multi-vendor network estates—FortiGate firewalls alongside third-party switches and access points across branch offices—NOC visibility is often fragmented. Ora’s Network Management System uses LLDP/CDP topology discovery and network path tracing to maintain a unified observability layer across the entire estate. ML-based anomaly detection can flag a managed endpoint suddenly sending large outbound volumes to an uncategorised cloud-storage endpoint—even if the traffic is encrypted and the EDR agent on that endpoint has not yet fired. Auto-healing policies can isolate the suspect endpoint at the switch port level while the SOC investigates.
Video Surveillance (VMS) — Physical and Network Security Under One View: For manufacturing, retail, and multi-site organisations, Ora’s video surveillance (VMS) module manages ONVIF/Hikvision/Dahua cameras alongside network security events in a single operations view. This matters when an infostealer infection may correlate with a physical-security event—a contractor brought a USB drive onto the production floor, or a visitor connected a rogue device in a meeting room. Correlating physical and network events under one platform reduces investigation time and eliminates the blind spot between security teams.
SOAR — Meet the 6-Hour CERT-In Window: CERT-In’s 2022 directive mandates that Indian organisations report cyber incidents to the regulator within six hours of detection. For most organisations without automation, six hours is barely enough time to confirm that an incident is real, let alone draft a notification. Ora’s SOAR module includes pre-built connectors and automated response actions: when the SIEM fires a high-confidence infostealer indicator, a playbook automatically forces a password reset for the affected account, pushes a blocklist entry to the FortiGate to prevent C2 callbacks, raises a CERT-In notification draft, and pages the on-call analyst—all within minutes. Automation is what makes the six-hour window realistic at scale, not heroic manual effort.
If your organisation is running a fragmented security stack with no clear path to meeting the CERT-In timeline, speak with PJ Networks about a PrahiX Ora deployment assessment.
For Indian enterprise IT and security leaders reviewing their posture against infostealer threats, the following checklist provides a starting framework:
India’s Digital Personal Data Protection Act (DPDP Act) places obligations on Data Fiduciaries to implement reasonable security safeguards and to notify the Data Protection Board in the event of a personal data breach. Infostealer infections that result in the exfiltration of employee or customer PII—browser-saved form data, HR platform credentials, customer contact lists—constitute reportable events under this framework.
Organisations that can demonstrate continuous monitoring (SIEM), automated response (SOAR), and documented log retention (CERT-In 180-day direction) are better positioned to evidence compliance with both frameworks. This is not a guarantee of regulatory relief, but it is the kind of observable, documented security programme that supports compliance with DPDP Act obligations and with CERT-In’s expectation of prompt incident reporting.
The infostealer threat crystallises a shift that security professionals have been observing for several years: the enterprise perimeter has dissolved, and the new perimeter is the authenticated credential. Attackers no longer need to penetrate firewalls or exploit zero-days when they can simply buy a valid session cookie for ₹3,000 on a darknet market and walk through the front door.
Defending against this requires a layered response: FortiGate with TLS inspection and DNS filtering to prevent payload delivery; ZTNA to make stolen credentials harder to weaponise; SOC monitoring to detect anomalous authentication events; and SOAR automation to respond within the timelines that CERT-In and the DPDP Act demand.
PJ Networks works with Indian enterprise clients to design, deploy, and operate exactly this kind of layered security architecture—anchored by FortiGate at the network layer and by the PrahiX Ora platform in the operations centre. If you would like to assess your current exposure to infostealer-driven credential theft, contact our team for an initial consultation.