Picture the incident call. A developer flags that their browser keeps logging them out, nothing dramatic, just an annoyance. By the time the responder images the laptop, the on-disk scan comes back clean. No dropped executable, no suspicious file, nothing for the antivirus to quarantine. And yet the saved passwords, the session cookies, and a fistful of AI API keys are already sitting on someone’s Telegram channel. This is the shape of cybersecurity work in 2026: the loot is gone, and the place you were trained to look is empty.

Three separate stories this week point at the same uncomfortable truth. The thing worth stealing has moved, the way it gets stolen has gone quiet, and the front door now looks completely ordinary.

The Stealer That Runs Where Your Scanner Isn’t

The newest variant of Phantom Stealer, detailed this week by Dark Reading, executes entirely in memory. Nothing meaningful touches the disk. On top of that, the infection chain layers in anti-analysis tricks built specifically to frustrate detection: it watches for sandboxes, stalls when it senses an analyst, and unpacks itself only when it decides the coast is clear.

If your detection strategy still leans on file hashes and on-disk signatures, a tool like this walks right past it. That’s the whole point. Fileless malware isn’t a clever edge case anymore; it’s the default design for credential theft because it works. The malware grabs what it came for, the browser password store, cookies, tokens, and exits before anything durable lands on the drive for your forensics team to find. Threat detection that only fires on files is detection that’s looking the wrong direction.

The Loot Moved To Browsers And API Keys

Notice what these campaigns actually take. Not your documents. Not your spreadsheets. They want the credentials your browser caches, the live session cookies that let them skip your login entirely, and increasingly, the secrets that make modern development run.

That last category is the one teams keep underrating. BleepingComputer reported that at least 15 malicious plugins on the JetBrains Marketplace were built to steal AI API keys straight off developer machines. Those keys are money. They bill to your account, they often carry generous rate limits, and they tend to live in plaintext config files or environment variables that no one rotates. A stolen OpenAI or Anthropic key doesn’t trip a login alert because there is no login. The attacker just starts spending, and your first signal is the invoice.

Put the two stories together and the pattern is obvious. Whether it’s a memory-resident stealer scraping your browser or a poisoned IDE plugin lifting your secrets, the target is the same: the keys to systems you already trust, harvested in a way that produces no obvious break-in. There’s no brute-force hammering on your firewall to spot. The credential simply gets reused, cleanly, from somewhere else.

The Front Door Looks Completely Normal Now

Delivery got friendlier too. Malwarebytes found dozens of fake World Cup streaming sites this month, all using football as bait to funnel visitors through a malicious advertising network. No exploit kit required. The user goes looking for a free stream, clicks through a few “play” buttons, and ends up one redirect away from a payload or a credential-harvesting page.

The JetBrains plugins worked on the same psychology. Developers trust the official marketplace the way sports fans trust a site that shows up first in search. Both assumptions are doing the attacker’s recon for them. When the malicious thing arrives through a channel you’ve already decided is safe, your defenses inherit that trust whether they should or not.

What To Do Before The Next Memory-Only Intruder

Start with the assumption that initial access will succeed and nothing useful will be on disk. That reframes the whole defense.

Right now, do three things. First, rotate the secrets that would hurt most if they leaked, AI API keys, cloud tokens, and anything sitting in a developer’s environment, and set hard spending and rate caps on every API key so a stolen one can’t run up an unbounded bill. Second, cut session lifetimes and require reauthentication for sensitive actions, because stolen cookies are only valuable while they’re live. Third, audit what your developers have installed from any marketplace and pull anything unrecognized; treat plugin and extension inventory as part of basic security hardening, not an afterthought.

For the longer haul, shift your threat detection toward behavior rather than files. Memory-resident malware leaves behavioral traces even when it leaves no artifacts: a browser process spawning unexpected children, an IDE reaching out to an odd domain, credential stores being read in bulk. Tune your EDR and your logging to catch those patterns. Lean on defense in depth so a single quiet theft doesn’t hand over everything: phishing-resistant MFA blunts reused passwords, network egress controls and a tightly scoped firewall policy make exfiltration noisier, and secret managers keep keys out of plaintext config in the first place. Layered threat-protection assumes any single layer will fail, and plans for it.

Then rehearse the incident response for the case that has no smoking gun. Your responders need a playbook for “the credentials are gone and the disk is clean,” one that pivots immediately to identity: which sessions to kill, which keys to revoke, which logs actually show the reuse. If your IR plan still starts with “find the malware sample,” it’s built for a kind of attack these crews stopped running.

Frequently Asked Questions

How do you detect malware that never writes to disk?

You watch behavior instead of files. Memory-only malware still spawns processes, reads credential stores, and makes outbound connections, so EDR tuned for those patterns and good process and network logging will catch what a file scanner misses.

Why are stolen AI API keys such a big deal?

They bill directly to your account, often with high rate limits, and they rarely trigger login alerts because using them isn’t a login. Treat them like passwords: store them in a secret manager, set spending caps, and rotate them on a schedule.

Sources

• Fileless Phantom Stealer Targets Browser Credentials
• Malicious JetBrains Marketplace plugins steal AI API keys from developers
• “Free World Cup stream” sites are serving scams, not football