When EDR Misses: Infostealers and the Dark Web Gap

Infostealers bypass endpoint protection far more often than most security teams expect. According to the SpyCloud 2026 Annual Identity Exposure Report, 40% of the 13.2 million infostealer infections observed in 2025 landed on endpoints already running endpoint detection and response or antivirus tools. That is not a rounding error; it is 4 in 10 infections running under the nose of the detection layer most organisations assume will stop credential theft before it leaves the machine.

The gap matters because what the attacker takes from those endpoints, cookies, tokens, password-manager vaults, keeps working long after the infection ends. The Verizon DBIR 2026 attributes 48% of all breaches to ransomware, and most of those ransomware intrusions start with credentials bought from the same criminal markets where infostealer logs are traded. CTDefense built its dark web monitoring practice around closing exactly that gap.

How Infostealers Evade Endpoint Detection

The current generation of infostealers, Lumma, StealC, Vidar, and the Redline successors, is built around short, in-memory execution. The binary unpacks, harvests credentials in seconds, exfiltrates to a drop server, and either self-deletes or is wiped by the loader. Modern infostealer evasion techniques work because the sample often never writes a persistent file, never schedules a task, and never calls the network APIs that behavioural detection is tuned to flag.

In practice, that answers a question many buyers ask, how do infostealers steal credentials without triggering EDR: they execute in memory, harvest in seconds, and self-delete before the behavioural model has enough telemetry to decide anything.

Three operational realities compound the problem:

• Signed loaders and legitimate installers. The initial dropper is often bundled with a cracked game, a fake software update, or a GitHub repository disguised as a legitimate tool. Code signing from a stolen or purchased certificate buys the sample enough reputation to clear the first gate.
• Living-off-the-land data access. The sample reads browser SQLite stores and Windows credential vaults the same way a legitimate application would. No injection, no hooking, no behaviour that stands out from an ordinary user-mode process.
• Infection volumes high enough to burn samples. Operators ship new builds daily; by the time a hash is attributed, the next build is already in circulation. Static signatures stay permanently behind the curve.

None of this makes endpoint protection useless. It makes it a necessary layer, not a complete one.

What Infostealers Take Beyond Passwords

The buyer conversation often stops at “stolen passwords”, which understates the problem. The SpyCloud 2026 figures show the breadth of what a single infection yields.

• Session cookies. SpyCloud recaptured 8.6 billion session cookies from infostealer logs in 2025. Session cookie theft matters more than many password compromises because a valid session token bypasses multi-factor authentication by design; the attacker reuses the cookie and the identity provider never sees a fresh login.
• Password-manager master passwords. 1.1 million master passwords were recaptured in 2025. One master password unlocks every stored credential, and most password managers do not treat a correct master password from a new device as suspicious until well after the vault has been dumped.
• API keys and access tokens. 18.1 million API keys and tokens were exposed through infostealer logs. These are the credentials cloud workloads use to talk to each other; a leaked long-lived token lets an attacker move laterally into a cloud environment without ever touching an interactive login.
• Autofill form data. Addresses, phone numbers, partial card details, and answers to common security questions. Low-value individually, useful for social-engineering the help desk when the attacker needs an MFA reset.

The point is not that any single artefact is catastrophic. The point is that one infected endpoint typically yields the full set, and all of it is tradeable within hours.

From Endpoint to Criminal Market

The path from a running infostealer to a weaponised breach is faster than most incident-response plans assume. A rough timeline, built from public reporting across Telegram-channel observers and infostealer-log aggregators, looks like this:

• Hour 0: infection and credential harvest.
• Hour 1 to 24: logs posted to Telegram channels operated by the stealer family, often as free samples with the full dataset sold via a bot.
• Day 1 to 7: logs are purchased, parsed, and sorted by access brokers who filter for corporate email domains, VPN portals, and cloud-management panels.

For readers meeting the term for the first time, what is an initial access broker: an IAB is a threat actor who buys stolen credentials or session tokens from stealer operators, verifies the access works, and resells it, usually to ransomware affiliates, within days of the original infection. The DBIR’s 48% ransomware figure sits downstream of this trade.

The organisational implication is awkward. By the time an EDR alert fires on the ransomware stage, the credential that opened the door has already changed hands two or three times. The upstream signal, the fact that the credential appeared in an infostealer log in the first place, was available days or weeks earlier, on a channel the endpoint agent cannot see.

What Dark Web Monitoring Catches Instead

Dark web monitoring operates in the layer EDR cannot reach: the Telegram channels, criminal forums, and private marketplaces where infostealer logs are traded. Dark web credential monitoring does not replace endpoint protection; it closes the specific blind spot that endpoint protection has by design.

A reasonable question from a buyer who already runs EDR is this one, does dark web monitoring detect infostealer logs: infostealer logs circulate across Telegram channels and criminal forums within hours of an infection, and dark web monitoring continuously watches those feeds for an organisation’s domains, email addresses, and session artefacts before any attacker weaponises the data.

A typical CTDefense finding is concrete and actionable rather than noisy. The alert surfaces:

• The specific credential or session artefact observed, the email address, password hash, cookie for a named domain, or API token prefix.
• The infected host details available from the log, operating system, browser, country of origin, and the antivirus or EDR product running on the machine at the time.
• The log source, the date it was offered for sale, and whether it has already been bundled into a public combolist.
• A recommended containment action: force password reset, revoke the active session, rotate the API key, isolate or reimage the device.

The value is time. A credential surfaced in an infostealer log 72 hours after infection and reset the same day never becomes a listing on a broker’s panel. For a wider view of the detection surface, what dark web monitoring actually catches covers the categories of leaked material end-to-end, and what infostealers harvest from corporate machines walks through a representative log file artefact by artefact.

Pairing EDR with Dark Web Monitoring

Organisations that recently deployed EDR made the right investment; it stops a large class of attacks that nothing else stops. The honest framing is that infostealers are the attack type EDR is weakest against, that the weakness has a measured size in the SpyCloud 2026 numbers, and that the Verizon DBIR tells the organisation what happens downstream if the gap is left open.

CTDefense works with finance, healthcare, technology, and manufacturing teams who want the credential-exposure signal in time to act on it rather than in a breach report after the fact. For organisations preparing for an ISO 27001 or NIS2 audit, or whose boards have asked what happens if an infostealer lands on an executive laptop, CTDefense Dark Web Monitoring is the detection layer that sits where the stolen credentials actually travel. Similar organisations are encouraged to review their endpoint protection stack alongside their visibility into criminal underground channels; the two layers answer different questions, and both are needed.