SSH material is the authentication data used to log in to remote systems over SSH, most often private keys, key passphrases, or related credentials stored on a workstation. Unlike a simple password, SSH material can provide direct access to servers, repositories, and admin tools without needing a browser session.
It matters because stolen SSH material can turn one compromised endpoint into broader infrastructure access. In infostealer campaigns, attackers look for key files, decrypted key stores, and passphrases so they can reuse legitimate credentials and blend in with normal administration. Defenders treat this as high-risk material: they monitor for key theft, restrict where keys are stored, use strong passphrases, rotate exposed keys quickly, and prefer hardware-backed or short-lived authentication when possible. If SSH material is exposed, password resets alone may not be enough; the key itself may need revocation and replacement.