Wiz: Infostealers Turn Stolen Developer Credentials Into Cloud and AI Breaches

A mature supply chain behind the malware

Wiz describes modern infostealer attacks as the product of a layered, industrialized criminal economy. It starts with Malware-as-a-Service platforms, where infostealers such as Lumma and RedLine are rented for as little as a few hundred dollars a month. According to Wiz, these tools are built to harvest data quickly and quietly: they execute, scrape credentials and exfiltrate data in seconds, often on devices that run up-to-date antivirus software.

The stolen logs are then sold on underground marketplaces, frequently through Initial Access Brokers. Wiz says these brokers curate the logs, validate valuable credentials and sell verified access to high-level adversaries such as ransomware cartels. The time between an employee clicking a phishing link and the sale of corporate cloud credentials can range from hours to many weeks or months.

Wiz notes that Microsoft, Recorded Future and Verizon's DBIR all point to infostealers as a major concern.

What the data shows about stolen secrets

Wiz analyzed secrets detected on infected machines through its integration with NordStellar. The picture is concentrated: Lumma C2, RedLine and Vidar account for 85.7% of all detected incidents. NordStellar also identifies over 400 distinct types of non-credential secrets being harvested.

• Cloud: AWS and GCP account for 46% and 13% of all compromised secrets, respectively.
• Code platforms: GitHub App Tokens, OAuth tokens and Personal Access Tokens make up roughly 10% of the total.
• AI platforms: they comprise 5% of stolen secrets, led predominantly by OpenAI API keys.

Wiz says AI credentials are lucrative because attackers can run their own workloads or resell access in the illicit LLM resale market. The keys could also potentially expose historical chat logs containing sensitive corporate data, though Wiz states it is not aware of public occurrences of this scenario.

Distribution methods remain fairly traditional. Legitimate Windows binaries such as vbc.exe, the Visual Basic compiler, are frequently abused for execution. Trojanized gaming-related files, including Roblox.exe and Valorant SkinChanger.exe, point to attacks on developers' personal machines, which Wiz says are often less protected than corporate endpoints. More recently, infostealer-like malware such as Miasma has targeted CI/CD pipelines, development servers and build processes by hijacking the latest version of a commonly used software dependency.

From an infected endpoint to the cloud

The path to a cloud breach begins on a device that is already logged in to the targeted service and has recently been infected. Rather than breaking MFA, attackers steal the session token created after a user authenticates. Using that token in their own browser, they act as the legitimate user and bypass MFA prompts. Wiz points to its earlier investigation into JINX-0164 as an example.

For AWS, Wiz says attackers focus on long-term IAM access keys, often stored in plain text in configuration files or source code on developer workstations, and on the active session cookie for the AWS Management Console. Cookies are typically taken from a browser's on-disk cache, but modern browsers also allow retrieval from memory, either by injecting code into the browser process or by attaching a debugger.

Several files under the .aws directory are of interest:

• ~/.aws/config holds no secrets but reveals which profiles, roles and accounts a victim can reach.
• ~/.aws/credentials can contain Access Key IDs and Secret Access Keys.
• ~/.aws/cli/cache/ stores temporary STS tokens that last from 1 to 12 hours depending on configuration, making them somewhat less useful unless sold immediately.
• ~/.aws/sso/cache/ contains long-lasting OIDC tokens that typically last up to 90 days.

Wiz says the SSO cache is the most critical of these. Unless the user runs aws sso logout or an admin revokes the session, a stolen token lets attackers continuously mint fresh AWS credentials. The firm also notes that some third-party tools, such as gimme-aws-creds, may write temporary tokens into the credentials file, while tools like Granted use the operating system's keychain, which it describes as a more secure alternative.

What it means for defenders

The analysis argues that identity is the main attack surface of the cloud and that developer endpoints are the weak link. Because session tokens and long-lived keys can be used without touching MFA, strong authentication alone does not close the gap. Wiz frames its mapping of targeted cloud keys as a first step toward a resilient defense, and its data suggests that teams should pay particular attention to long-lived tokens, plaintext keys in configuration files and the protection of personal machines used for development.