Infostealer malware was the primary vector for the Snowflake breaches, harvesting credentials that remained valid for years due to lack of rotation. This malware family is widely available on cybercrime markets, enabling attackers like UNC5537 to compromise accounts at scale without exploiting platform vulnerabilities.