An infostealer is malware whose sole job is to harvest credentials at scale: passwords saved in browsers, session cookies that bypass logins entirely, cryptocurrency wallets, and autofill data, exfiltrated in seconds and sold as searchable "logs" on criminal markets. Unlike ransomware it announces nothing — the infected user rarely notices — and unlike phishing it needs no mistake from you in the moment, just one poisoned download. Industry tracking through the mid-2020s counts millions of infected machines and billions of harvested credentials; Google's own threat-analysis teams have described stealer logs as a top driver of account compromise, and the FBI issued a 2025 advisory on infostealers tied to credential-driven bank fraud.
What exactly gets stolen?
The inventory explains the damage:
- Saved browser passwords — extracted from Chrome, Edge, and Firefox stores, often along with the password manager's own database file.
- Session cookies and tokens — the crown jewel: a valid session cookie logs the criminal in as you, with no password, and often no MFA prompt, because the session was already authenticated. This defeats SMS and app-based codes that are not tied to the device.
- Crypto wallet files and seed phrases — found on disk, in clipboard monitoring, or in screenshots.
- Autofill and form data — names, addresses, card numbers, and the answers to security questions.
- Screenshots and system inventory — capturing open windows and installed software, including whether a password manager or corporate VPN is present, which raises the log's resale price.
How do infections happen?
Almost always by voluntary download, dressed as something else. The dominant channels: malvertising and fake download sites for popular software (cracked applications above all — game cheats, pirated professional software, "free" versions of paid tools are the persistent leaders), malicious files from YouTube-tutorial links and gaming Discord servers, and email attachments. The payload is commonly packed inside a legitimate-looking installer — often a real copy of the requested program, so the victim's software works while the stealer runs beside it — a technique tracked under names like Nullifier, and adopted by the major stealer families including Redline, Lumma, and Stealc through their many takedowns and resurrections. Takedowns happen — Operation Magnus against Redline in 2024, repeated Lumma disruptions since — and the criminal market reconstitutes within weeks, because the malware-as-a-service model means builders and users are different people.
Why do MFA and strong passwords lose here?
Because the stealer steals the session, not the password path. When you log in and check "remember this device," the site stores a session cookie; the criminal imports that cookie into their own browser and appears as your already-authenticated device. Password-based MFA — the code from SMS or an app — defends the login, not the logged-in state. This is why security teams treat stealer infections as full account compromise regardless of password strength, and why the response (below) is not "change your passwords" alone but "revoke every session everywhere."
How do you know if you were hit?
Direct signs are scarce by design. Watch instead for: unrecognized logins or password-reset emails from services you have not touched, sessions in account security pages you do not recognize, missing crypto or unusual payment-card activity, and — before any of that — antivirus detections during installs, which deserve to be taken seriously rather than clicked past. If a machine downloaded software from an ad, a crack site, or a tutorial link in the past year and then showed any odd account behavior, treat the infection as confirmed and act accordingly.
What should you do after an infostealer infection?
- Isolate and rebuild. Assume the machine is untrustworthy — full antivirus scan at minimum, OS reinstall for anything serious. Stealers drop additional payloads, and rebuilding is faster than proving a negative.
- From a clean device, rotate everything stored or typed on the infected machine: password manager contents in full, email first. Reuse anywhere means those accounts too.
- Revoke all sessions on every important account — this kills the stolen cookies — then re-login fresh on trusted devices only.
- Check recovery settings for planted attacker contacts, and move crypto funds off any wallet whose files touched the machine.
- Report to the FBI's IC3 — stealer-driven bank fraud is exactly what its 2025 advisory tracks.
How do you avoid it?
The prevention list is short and unglamorous: never download cracked or pirated software — the single dominant source; get software from official sites typed directly or app stores, never from ads or search; keep the OS and browser updated; and use a password manager with unique passwords so one harvested credential is one account, not your whole life. For high-value accounts, hardware security keys or passkeys bound to a device raise the cost of stolen cookies, since those credentials do not travel. The stealer economy runs on volume and careless downloads; starving it of those two inputs is most of the defense.
For more context, read Botnets and residential proxies: how your spare router earns money for criminals.
For more context, read vishing.