Companies told to adopt digital risk protection services
ISLAMABAD: A leading cybersecurity company Friday warned Pakistani companies to hire digital risk protection services to avoid “infostealer infections” attacks used to steal corporate data.
A new research by Kaspersky Digital Footprint (DFI) has discovered that more than one-third of infostealer infections start when users run files directly from temporary browser folders, showing that user behaviour remains a key factor behind credential theft. Just 32 percent of infostealer attacks use process injection and living off the land techniques, typical of advanced malware families
Kaspersky DFI researchers analyzed 5 million infostealer log files discovered on the dark web in 2025. These logs, which contain data stolen from compromised devices such as account credentials, browser cookies and system metadata, also revealed the original locations of malicious files on infected machines.
The most common location was the Windows temporary directory, C:\Users\ AppData\ Local\Temp, which accounted for approximately 35 percent of all observed cases. This folder is commonly used to store files downloaded from the internet before they are explicitly saved by a user: a significant share of infections occurs when users directly launch downloaded files, without attackers relying on sophisticated evasion techniques.
The analysis indicates that infections are often linked to two risky user actions: downloading software from untrusted sources and attempting to activate software illegally. In many cases, victims follow instructions provided by threat actors and disable security software before running malicious files. According to the research, many malicious files were disguised as legitimate software installers, activators or game modifications. While game mods remain a common lure, attackers frequently adapt the same techniques to distribute virtually any type of software.
“Infostealers surged in 2025, with infections rising 59 percent year over year. Our analysis shows that user behaviour remains a key factor behind many of these compromises.
Copyright Business Recorder, 2026
Comments