SmallBizSecurityTipsBreach & credential monitoring
Home / Guides / MFA & infostealers
Security explainer

We have MFA - do we still need credential monitoring? (Infostealers explained)

Updated August 2026 · independent comparison · primary sources linked

Yes, you still need credential monitoring even with MFA everywhere, because the fastest-growing attack doesn’t bother with your password or your second factor. Infostealer malware steals the active session cookies already sitting in a logged-in browser. An attacker imports that cookie and resumes your session as if they’d passed MFA, because, from the app’s view, someone already did. MFA raises the bar against password-only attacks; it does not stop session hijacking. Monitoring stealer-log data is how you find out a device was compromised.

How MFA gets bypassed without breaking it

MFA protects the login event. But once you log in, the app issues a session token/cookie so it doesn’t ask again on every click. Infostealers (RedLine, Lumma, Vidar and their successors) harvest those tokens, plus saved passwords and autofill data, straight off an infected device. With a valid session cookie an attacker:

This is why enterprise tools like SpyCloud emphasise “post-infection remediation”, invalidating sessions, not just resetting passwords.

The key nuanceResetting the password after an infostealer hit is not enough. If you don’t also invalidate active sessions and remove the malware, the stolen cookie may still work and the device may just re-steal the new credentials.

Why this ties back to monitoring

Classic breach checkers see database dumps. Infostealer data shows up in stealer logs, and that’s exactly where you learn one of your team’s devices is infected, often before any account is misused. Have I Been Pwned has ingested some stealer-log data; dedicated platforms (Flare, SpyCloud) specialise in it. Either way, monitoring is your signal that MFA alone won’t save this account.

What to do about it

  1. Keep MFA on, ideally phishing-resistant (passkeys / FIDO2), which also resists many real-time phishing proxies.
  2. Monitor stealer-log exposure so an infection surfaces fast.
  3. On any hit: invalidate sessions (force sign-out everywhere) as well as resetting the password.
  4. Run real endpoint protection and patch, the malware is the root cause; the leaked cookie is the symptom.
  5. Shorten session lifetimes for sensitive apps so a stolen cookie expires sooner.

The CISA/NSA/FBI advisory AA22-137A puts weak credential and access controls at the top of routinely exploited weaknesses; session theft is the modern twist that makes “we have MFA” an incomplete answer.

Related toolBreachTrigger is the simplest way to get an early warning when a public-company vendor, cloud provider or partner you depend on discloses a breach: it watches U.S. SEC EDGAR every ~30 minutes and alerts you the moment a company files an Item 1.05 “material cybersecurity incident” 8-K. It does not scan dark-web dumps for your own passwords, so it is not a like-for-like HIBP alternative, it solves a different problem: vendor and third-party breach early warning. See BreachTrigger → (free weekly digest; instant alerts from $199/mo).
Bottom line: MFA is necessary and you should keep it, but infostealers steal the session after login, so credential/stealer-log monitoring plus session-invalidation and endpoint protection are what close the gap. “We have MFA” is a starting line, not a finish line.

Frequently asked questions

If we use MFA, do we still need dark web / credential monitoring?
Yes. Infostealer malware steals active session cookies from a logged-in browser, letting an attacker resume the session without a password or MFA challenge. Monitoring stealer-log data is how you learn a device was compromised, and it tells you to invalidate sessions, not just reset a password.
How do attackers bypass MFA?
The common method today is session-cookie theft: malware or a real-time phishing proxy captures the authenticated session token issued after you log in. Importing that token resumes your session, so the attacker never faces the MFA prompt. Passkeys/FIDO2 and short session lifetimes reduce, but do not fully eliminate, the risk.
Is resetting the password enough after an infostealer infection?
No. You must also invalidate active sessions (force sign-out everywhere) and remove the malware from the device. Otherwise the stolen session cookie may still work, and an active infection can simply steal the new password too.
What is a session cookie and why does it matter?
A session cookie (or token) is what an app stores in your browser after you log in so it doesn't re-prompt you on every action. Because it represents an already-authenticated session, stealing it lets an attacker act as you without needing your password or second factor.

Primary sources

  1. CISA & partners, Advisory AA22-137A: “Weak Security Controls and Practices Routinely Exploited for Initial Access”
  2. NIST SP 800-63B: Digital Identity Guidelines (Authentication)
  3. Have I Been Pwned: homepage breach counts & FAQ
  4. Troy Hunt: blog (HIBP announcements, stealer logs)