Flashpoint Shows Infostealers Now Run at Machine Speed
Flashpoint says infostealer malware infected 7.4 million devices and harvested 1.7 billion credentials in the first half of 2026. Vidar, StealC, and Lumma were the most prolific families in the report.
The shift is operational, not just volumetric: stolen log data is now automatically parsed for useful metadata and pushed into credential-stuffing and active-session tests across thousands of environments. That turns a theft dump into a ready-made login pipeline, so password resets and MFA prompts can be outrun by follow-on access attempts.
For teams that still depend on passwords, browser sessions, and MFA to stop account takeover, the exposure is no longer deferred until a human attacker acts. The window between credential theft and live abuse is now short enough that stolen logs can become intrusion attempts before normal response cycles catch up.