---
id: 8832
title: "The Infostealer Incursion: How Stolen Credentials Breach Cloud, Code, and AI Environments"
source_domain: wiz.io
source_url: "https://www.wiz.io/blog/infostealer-incursion-cloud-ai-credentials"
published_at: "2026-09-25T14:51:15Z"
tags: ["ai-security", "cloud", "cloud-security", "credential-theft", "session-tokens", "malware-as-a-service", "wiz-research", "infostealers", "initial-access-brokers"]
phying_url: "https://phying.com/item/8832"
lang: en
---

# The Infostealer Incursion: How Stolen Credentials Breach Cloud, Code, and AI Environments

## Summary

Wiz Research analyzes NordStellar logs to map credentials harvested by infostealers like Lumma and RedLine, showing how stolen keys and tokens unlock AWS, Azure, GitHub, and AI platforms.

## Intelligence Metadata

- **Sources:** wiz.io
- **Published:** 2026-09-25T14:51:15Z
- **Original:** https://www.wiz.io/blog/infostealer-incursion-cloud-ai-credentials
- **Phying News:** https://phying.com/item/8832