Common signs of infostealer activity

Here are common signs that an infostealer may be active in or around your organization:

• Unexplained logins from unusual devices or patterns: such as new user agents, login times outside policy windows, or logins without MFA challenges.

• Persistent session anomalies: such as long-lived sessions across multiple geographies or reuse of expired tokens.

• Abuse of internal trust: such as phishing emails sent from real employee accounts.

• Privileged account activity outside normal behavior: including escalation, configuration changes, or access to high-risk systems.

• Login attempts using credentials tied to inactive or offboarded accounts: often the first assets tried by attackers.

• New or unmanaged devices accessing internal systems: especially if they appear suddenly in SSO logs or access telemetry.

Why these signals matter more together than alone

While none of these signs confirm an infostealer infection on its own, they often appear in the wake of one. Early detection depends on connecting weak signals, across devices, identities, and session behavior, before they escalate into a breach.

Passguard adds another layer to this picture: instead of waiting for these signals to appear internally, it monitors the criminal marketplaces where stolen sessions from your organization would surface first.