Global Technology Firm Detects Lumma Stealer SSO Credential Exposure 36 Hours Before Ransomware Deployment
Executive Summary
The infostealer-to-ransomware pipeline has compressed to a timeline that most enterprise security programs were not designed to match. Research published in early 2026 documented the full lifecycle: infection to dark web marketplace listing in under 48 hours, and ransomware deployment commonly following within 48 hours of the credentials appearing for sale. The entire chain, from a malware infection on an unmanaged personal device to an encrypted corporate infrastructure, can be completed in under four days. For organizations operating on weekly threat review cycles and breach detection timelines measured in weeks, that compression is not a gap. It is a structural vulnerability.
This case study examines how a global technology company closed that gap. A Lumma Stealer infection on a developer’s personal laptop harvested an active Microsoft Entra ID session cookie and VPN credentials before self-deleting without a trace. Constella’s continuous infostealer monitoring detected the harvested log within hours of its appearance on an underground marketplace, 36 hours before forensic analysis estimated an Initial Access Broker would have completed the ransomware staging process. The session was invalidated, the credentials rotated, and the IAB’s first authentication attempt failed against credentials that no longer existed.
The Context: Why SSO Credentials Have Become the Primary Ransomware Entry Point
The enterprise identity landscape has undergone a structural shift that the infostealer economy recognized before most security programs did. As organizations consolidated authentication around centralized identity platforms, Microsoft Entra ID, Okta, AWS IAM Identity Center, and similar providers, they created a single credential that unlocks not one system but every system connected to that identity provider. A single valid Entra ID session does not grant access to one application. It grants access to every application integrated with Entra ID, which in a typical enterprise means email, cloud infrastructure, internal SaaS tools, VPN, remote management platforms, and collaboration systems simultaneously.
Research published by Flare in February 2026, analyzing 18.7 million infostealer logs from 2025, found that more than one in ten infections already contained enterprise SSO or identity provider credentials. By late 2025, that rate had risen to 16% of infections, and projections placed it at one in five by the third quarter of 2026. Microsoft Entra ID appeared in 79% of enterprise identity logs in the dataset. The acceleration reflects a deliberate targeting shift: infostealer operators, and the Initial Access Brokers who purchase their output, have identified SSO credentials as the highest-value harvest available from any infected device.
For the security team at this organization, that context was not abstract. They had integrated Constella’s infostealer monitoring into their SOC workflow specifically because they recognized that their EDR coverage had a boundary: managed corporate devices. The developer population, which routinely worked across personal and corporate devices and used browser-saved credentials for convenience, sat partially outside that boundary. If a personal device was infected, the EDR would not see it. The only signal would be external, appearing on a criminal marketplace where the harvested log was listed for sale.
The Infection: Lumma Stealer on an Unmanaged Device
The infection vector was consistent with the most common Lumma Stealer distribution pattern in 2025 and 2026: a malicious software crack distributed through a pirated developer tooling repository. The developer, working from a personal laptop while traveling, downloaded what appeared to be a licensed version of a commonly used code analysis tool. The download contained a Lumma Stealer payload embedded alongside the functional software.
Lumma Stealer, the fastest-growing infostealer through 2025 and into 2026, operates with a specific targeting profile. It prioritizes browser-stored session cookies, particularly for SSO providers including Microsoft, Google, Okta, and AWS. It harvests VPN credentials, cryptocurrency wallets, and SSH keys as secondary targets. Its anti-analysis capabilities are sophisticated: on this device, the payload executed, completed data collection, packaged the output into a structured log file, transmitted the log to its command-and-control infrastructure, and deleted itself, all within approximately 40 minutes of execution. The functional software the developer believed they had downloaded launched normally afterward. There was no user-visible indication that anything had occurred.
The harvested log contained:
- An active Microsoft Entra ID session cookie with a remaining validity window of approximately 18 hours, generated during the developer’s most recent authentication to the organization’s cloud environment.
- Saved browser credentials for the organization’s VPN gateway, including the URL, username, and password.
- An Okta session token from the partner access portal, still active.
- Hardware identifiers for the infected device, including the HWID, system locale, and installed software inventory.
- Browsing history and autofill data from Chrome and Firefox profiles on the device.
Within hours of the log’s collection, it was packaged and uploaded to Russian Market, an underground marketplace that specializes in fresh infostealer credential sales and applies a freshness premium to logs collected within the preceding 24 to 48 hours. The listing price reflected the Entra ID session cookie: enterprise SSO credentials with confirmed active sessions command significantly higher prices than standard credential pairs. The log was purchased by an Initial Access Broker within hours of listing.
The Detection Gap This Attack Was Designed to Exploit
The organization’s security architecture was mature by the standards of its peer group. Enterprise-wide EDR coverage on all corporate devices. Phishing-resistant MFA on all remote access. SIEM-based anomaly detection with dedicated SOC analyst coverage. A quarterly vulnerability management program. A threat intelligence subscription providing IOC feeds and dark web keyword monitoring.
None of these controls had visibility into what had happened. The infection occurred on a personal device outside the EDR policy boundary. The Lumma Stealer payload self-deleted before any behavioral detection could fire. The session cookie was valid, meaning no anomalous authentication event had occurred yet. The SIEM had no log of the infection, the harvest, or the marketplace listing. The threat intelligence keyword monitoring was domain-based, not log-based, and the log had not yet been used to attempt authentication against the organization’s systems.
The attack was structurally invisible to every internal detection control the organization operated. The only place where it was visible was external, on the criminal marketplace where the log was listed, and in the infostealer package feed where Constella’s monitoring operates continuously.
The Solution: Continuous Infostealer Package Monitoring
Constella’s monitoring operates against the organization’s corporate domains and identity population continuously across breach repositories, paste sites, dark web forums, and, critically, infostealer package feeds. When a newly ingested infostealer package contains credentials, session cookies, or device identifiers associated with a monitored domain, Constella generates an alert with the full package context: the specific URLs and applications with active sessions captured, the malware strain responsible, the infected device’s hardware metadata, and the recency of the log.
Approximately nine hours after the developer’s personal device was infected, Constella’s monitoring flagged the organization’s Entra ID domain in a newly ingested Lumma Stealer package. The alert reached the SOC analyst on duty within minutes of ingestion. The alert payload included:
- Session data: Active Entra ID session cookie for the organization’s tenant, with the specific authentication domain and estimated remaining session validity.
- VPN credentials: Username and plaintext password for the organization’s VPN gateway URL.
- Okta session: Active partner portal session token.
- Malware attribution: Lumma Stealer variant, version signature consistent with the distribution wave active in that period.
- Device metadata: HWID, system locale confirming a non-corporate-inventory device, and software profile.
- Marketplace context: Log listed on Russian Market within the preceding six hours, purchase activity detected.
The alert was high-confidence, current, and operationally complete. The analyst did not need to investigate whether the alert was real. Every field confirmed it was. The question was how fast the team could execute remediation before the IAB’s purchased access was deployed.
The Response: 90 Minutes from Alert to Full Remediation
The SOC escalated to the identity security team immediately. Remediation executed in parallel across four tracks:
- Session invalidation: The Entra ID session associated with the developer’s account was revoked across all connected applications. The Okta session was terminated simultaneously. This closed the MFA bypass window: the IAB could not replay the stolen session cookies against a revoked session.
- Credential rotation: The developer’s VPN credentials were reset and the account locked pending re-enrollment. The VPN gateway URL from the Constella alert was confirmed as an active organization endpoint, and the specific credential pair was invalidated at the gateway level before any authentication attempt could succeed.
- Developer notification and device triage: The developer was contacted and guided through a personal device wipe and OS reinstall procedure. The device was confirmed as personal and outside corporate MDM, so remote wipe was not available, but the developer completed the reinstall within the incident window.
- Scope assessment via Hunter: The SOC used Constella’s Hunter platform to pivot from the specific log to the broader Lumma Stealer campaign, confirming that no other organizational identities appeared in packages from the same distribution wave. The scope was confirmed as a single device, single identity compromise.
Total time from Constella alert to confirmed full remediation: 88 minutes.
The Result: The IAB’s Access Attempt Failed
Forensic analysis conducted in the 72 hours following the incident established the timeline that made the outcome measurable. Log analysis from the VPN gateway confirmed that an authentication attempt against the developer’s VPN credentials was made from an IP address associated with known Initial Access Broker infrastructure approximately 36 hours after the Constella alert was received. The attempt was rejected because the credentials had already been rotated. Two subsequent attempts over the following four hours, using credential variants consistent with IAB testing methodology, also failed.
The organization’s threat intelligence team, analyzing the IAB’s infrastructure and trading patterns through Hunter, assessed the typical sequence following successful VPN entry by this actor cluster: internal reconnaissance via RMM tooling, domain controller access, backup system enumeration, and ransomware staging, with an estimated deployment timeline of 24 to 48 hours from initial VPN access. At the point of the failed authentication attempt, the estimated timeline to ransomware deployment was 36 hours.
The Constella alert had been received 36 hours earlier. Remediation had completed 88 minutes after the alert. The IAB’s first authentication attempt failed against credentials that had been rotated 34 hours prior.
Key Outcomes:
- Lumma Stealer infostealer log detected within 9 hours of infection, before any internal security control had generated a signal.
- Full remediation, session invalidation, credential rotation, and scope assessment, completed in 88 minutes from alert receipt.
- IAB’s VPN authentication attempt, confirmed 36 hours after the Constella alert, failed against already-rotated credentials.
- Estimated ransomware deployment timeline at point of detection: 36 hours. Actual outcome: zero access, zero encryption, zero ransom.
- Hunter pivot confirmed single-device, single-identity scope. No additional organizational identities exposed in the same campaign wave.
Lumma Stealer does not attempt to bypass MFA at the authentication layer. It harvests session cookies after MFA has already been satisfied by the legitimate user. An active session cookie is the browser’s record that authentication, including MFA, was completed successfully. When an attacker replays a stolen session cookie, the target system treats the request as a continuation of a session that was already authenticated. No MFA challenge is triggered because the challenge was already answered by the real user during the original session. Preventing this attack requires detecting the cookie theft before the stolen session is replayed, which is precisely what Constella’s infostealer monitoring is designed to do.
The developer’s personal laptop was outside the organization’s EDR policy boundary. Enterprise EDR deployments cover managed, corporate-enrolled devices. Personal devices used to access corporate systems, particularly in developer populations where this is common, sit outside that boundary. The only internal indicator that the device was infected would have been a behavioral anomaly on the device itself, which the EDR was not present to observe. Constella’s external monitoring fills this gap by watching criminal markets rather than managed endpoints. The signal appeared externally, on the marketplace where the log was listed, before it appeared internally as an authentication event.
Three factors compressed the response time. First, the alert contained specific, verified operational context rather than a low-fidelity indicator requiring investigation: the exact session domain, the VPN gateway URL, the malware strain, and the marketplace purchase confirmation. The analyst’s first task was escalation, not validation. Second, the identity security team had pre-established incident response procedures for infostealer session compromise that could be executed immediately without a planning phase. Third, Constella’s Hunter platform provided instant scope assessment, confirming the breach was contained to a single identity rather than requiring hours of manual OSINT to determine the blast radius. The combination of high-quality intelligence and pre-established procedures is what made 88 minutes possible.
SSO credentials represent a multiplicative access event rather than a single-system compromise. A valid Microsoft Entra ID session does not provide access to one application. It provides access to every application integrated with that tenant, which in a typical enterprise includes email, cloud infrastructure, internal SaaS platforms, VPN, remote management tools, and collaboration systems. The IAB economy prices access accordingly: an Entra ID session with confirmed enterprise access commands significantly more than standard credential pairs because the downstream value to a ransomware operator is proportionally higher. Research from early 2026 found Microsoft Entra ID appearing in 79% of enterprise identity logs in infostealer datasets, reflecting deliberate targeting of the identity provider with the broadest enterprise footprint.
Conclusion
The infostealer-to-ransomware pipeline is not a theoretical threat model. It is a documented, repeatable sequence with a compressed timeline that most enterprise security architectures were not designed to match. Infection to dark web listing in under 48 hours. Ransomware deployment within 48 hours of the credentials appearing for sale. The entire chain can be completed before a weekly threat review cycle has even begun.
For this organization, the outcome depended entirely on having a detection capability that operated outside the boundary of their internal controls, watching the criminal marketplace where the threat became visible before it became an incident. Constella’s infostealer monitoring provided that capability. The 36-hour window between detection and the IAB’s first failed authentication attempt was not luck. It was the direct product of detecting the exposure in the external environment where it first appeared, rather than waiting for it to generate an internal signal.
Ready to close the infostealer detection gap in your security architecture?