How Infostealer Malware Steals Passwords and How to Stop It

You get a login alert from a country you have never visited, even though you use strong passwords and two factor authentication. Nothing looks wrong on your computer. In a growing number of cases like this, the cause is infostealer malware: a small program that quietly copies saved passwords, browser cookies and crypto wallets from your machine and ships them to an attacker within seconds.

This guide explains how infostealers get in, what they take, why they can bypass two factor codes, and the concrete steps that stop them.

What infostealer malware is

An infostealer is malware built for one job: grab valuable data fast and leave. Unlike ransomware, it does not announce itself. Many families run for under a minute, collect everything they can, upload it as a compressed file and then delete themselves.

The stolen bundle is often called a log. A single log from a home PC can include:

• Every password saved in Chrome, Edge, Firefox and other browsers
• Browser session cookies, which keep you logged in to websites
• Autofill data such as names, addresses and card details
• Crypto wallet files and browser wallet extensions
• Files from the desktop and documents folders matching names like "password" or "backup"
• A screenshot of the screen and basic system details

These logs are sold in bulk on criminal marketplaces, sometimes for less than the price of a coffee each. Buyers then sort through them for email accounts, business logins and anything linked to money.

How infostealers get onto your computer

Infostealers almost never break in on their own. They rely on you running something. The most common routes we see in incident reports are:

Fake software downloads

Search for a free version of a paid program, a game mod, a PDF converter or a video downloader, and some of the top results lead to infected installers. Attackers also buy search ads that imitate real software brands, so the first link on the page can be the malicious one.

Cracked games and cheats

Pirated games, key generators and cheat tools are a favourite delivery method, partly because the instructions often tell you to turn off antivirus first. That single step does the attacker's work for them.

Phishing attachments and fake updates

An email with an "invoice" archive, or a website pop up claiming your browser needs an urgent update, can run the same payload. Our guide on recognising a phishing attempt covers the warning signs in emails.

Copy and paste "fix" instructions

A newer trick shows a fake error or fake human verification page that asks you to press Windows key plus R, paste a command and hit Enter. The command downloads the infostealer directly. No legitimate website will ever ask you to do this.

Why infostealer malware can beat two factor authentication

Here is the part that surprises people. When you log in to a site and tick "stay signed in", the site gives your browser a session cookie. That cookie proves you already passed the password and two factor check. If an attacker steals the cookie and loads it into their own browser, the site often treats them as you, with no password and no code needed.

This is called session hijacking, and it is why a stolen log is so valuable. It explains many "but I had two factor on" account takeovers, especially for email, social media and advertising accounts.

The common advice that falls short: "just use a strong password"

Most security advice for individuals focuses on long, unique passwords. That is still good practice, and our guide to a strong passphrase you can remember shows how. But against infostealers, password strength barely matters. A 30 character password saved in your browser is stolen just as easily as "summer2024".

I would also push back on the idea that antivirus alone solves this. Infostealer builders repackage their code constantly, and fresh samples often slip past detection for the first few hours or days, which is exactly when most victims run them. The real protection is not running the file in the first place, and limiting what is stored on the machine if you do.

How to protect yourself from infostealers

1. Download software only from official sources. Use the developer's own site, the Microsoft Store or a trusted package manager. Type the address yourself rather than clicking search ads.
2. Never disable antivirus to install something. Treat that instruction as a confession that the file is malicious.
3. Move passwords out of the browser. A dedicated password manager with a strong master password is far harder for commodity infostealers to read than browser saved passwords.
4. Use passkeys or hardware security keys where offered. They stop password theft and phishing, though cookies can still be stolen, so the other steps still matter.
5. Sign out of sensitive accounts such as banking and work admin panels when you finish, so fewer long lived cookies sit on the machine.
6. Use a standard Windows account for daily use, not an administrator account. It limits what a malicious installer can change.
7. Keep Microsoft Defender on with cloud protection enabled. Our list of Microsoft Defender settings worth turning on takes about ten minutes.

What to do if you think you ran an infostealer

Speed matters, because stolen logs are often used within hours. Work through this order:

1. Disconnect the infected computer from the internet.
2. From a different, clean device, change the password for your main email account first, then banking, then everything else that was saved in the browser.
3. In each important account, use "sign out of all sessions" or "sign out everywhere". This kills stolen cookies, which a password change alone may not do.
4. Review recovery email addresses, phone numbers and forwarding rules for anything you did not add.
5. Move any crypto to a new wallet created on a clean device.
6. Reinstall Windows on the infected machine, or at minimum run a full offline scan with Microsoft Defender. A full reset is the safer choice.
7. For a work device, tell your IT contact immediately, even if it feels embarrassing.

Frequently asked questions

How do I know if I have infostealer malware?

Often you will not see anything on the computer itself, because many infostealers run once and delete themselves. The usual signs appear later: login alerts from unfamiliar places, password reset emails you did not request, or friends receiving strange messages from your accounts. If you recently ran a cracked program or an unknown download, assume the worst and follow the recovery steps.

Does changing my password remove an infostealer?

No. Changing passwords limits the damage from data already stolen, but the malware or its effects may remain on the device. You also need to sign out of all sessions to invalidate stolen cookies, and clean or reinstall the computer. Change passwords from a different, clean device.

Can infostealers steal passwords from a password manager?

Common infostealers mainly target browser saved passwords and cookies, which are much easier to read. A locked password manager with a strong master password is far better protected. If your manager is unlocked while the malware runs, some data may still be exposed, so locking it when not in use helps.