Infostealer malware - how passwords get stolen from your own device

There is a question that comes up whenever someone follows all the advice and still gets breached: my password was long, random and used nowhere else — how did anyone get it?

Usually the answer is that nobody guessed it. It was copied off a device.

Quick answer

An infostealer is malware that copies saved passwords, browser cookies and other credentials off a computer or phone and uploads them to an attacker. It runs once, finishes in seconds, and generally leaves no visible damage — the theft is the whole operation.

Two things make it different from the attacks most password advice is written for:

• It does not guess. Password length and randomness are irrelevant when the password is being read out of storage.
• It steals sessions, not just passwords. That is what lets it walk past two-factor authentication.

What actually gets taken

A single run typically collects:

• Passwords saved in the browser — every site, in one file
• Session cookies — the tokens that keep you signed in
• Autofill data — names, addresses, phone numbers, sometimes card details
• Cryptocurrency wallet files and browser wallet extensions
• Files matching common patterns, such as documents with "password" in the name
• A screenshot and a list of installed software, for context

The whole package is called a stealer log, and logs are traded and resold in bulk. This is why a credential can surface publicly years after an infection nobody noticed.

Why session cookies matter more than passwords

This is the part most guides skip, and it is the reason two-factor authentication sometimes fails to help.

That is the mechanism. Two-factor authentication protects the moment of signing in. A stolen session cookie skips that moment entirely.

It is not unstoppable, and the industry has started to close it. Google's Device Bound Session Credentials ties a session to hardware in the device — the TPM on Windows, the Secure Enclave on macOS — so a copied cookie is useless on another machine. It became generally available for Windows users in Chrome 146 in April 2026, with macOS following. Sites have to adopt it, so coverage is partial, but the direction is clear.

How devices get infected

Almost every route requires someone to run something. The persuasion is the sophisticated part; the malware is bought off a shelf.

• Cracked or pirated software, and key generators — the single most reliable delivery method there has ever been
• Fake installers for popular free apps, served by lookalike download sites
• Malicious search adverts that sit above the real result for a well-known program
• Files shared through gaming platforms, Discord or messaging apps, often as a mod, cheat or beta invite
• Fake job tests and briefing documents sent to freelancers and developers
• Copy-and-paste instructions on a page claiming to verify you are human, fix a broken video, or repair a document

That last one deserves its own warning, because it is the growth area and it does not look like a download at all. A page shows what appears to be a routine verification step and asks you to press a key combination and paste something. The paste is the malware. CAPTCHA scams covers how those pages are built and why the instruction is always the tell.

Why this changes what "good password hygiene" means

It does not make the usual advice wrong. It makes it incomplete.

The honest summary: password practices protect you from attacks against the services you use. Device hygiene protects you from attacks against you. Both are needed, and only one of them is what most advice talks about.

This also explains a pattern that confuses people. Credentials from stealer logs are what feed credential stuffing — automated attempts of leaked email-and-password pairs across hundreds of other sites. A password stolen from your laptop on Monday can be tried on your bank on Tuesday.

Are password managers still worth it?

Yes, and the reasoning is worth being precise about.

A password manager does not stop an infostealer. A vault that is unlocked when the malware runs can be read like anything else.

But it changes the shape of the damage in ways that matter. Your passwords are unique, so the log cannot be replayed across your other accounts. The vault locks after inactivity, so the exposure window is narrower than a browser's always-available saved passwords. And a manager will not autofill on a lookalike domain, which removes the phishing route entirely. How password managers work covers the trade-off in full.

How to reduce the risk

1. Install software only from official sources — the vendor's own site, the platform's app store. Type the address rather than searching for it, because the advert above the real result is a known delivery route.
2. Never run cracked software. There is no safe version of this.
3. Keep the operating system and browser updated. Automatic updates close the vulnerabilities that let files run without you agreeing.
4. Leave built-in protection on — Microsoft Defender, Gatekeeper and XProtect on macOS, Google Play Protect on Android.
5. Do not paste commands you did not write into a terminal, the Run box, or PowerShell.
6. Use passkeys where offered. There is no stored secret for a stealer to copy. Are passkeys safer than passwords covers what they do and do not fix.
7. Sign out of things you are not using, especially on shared or work machines. A session that has ended cannot be replayed.

If you think you have been hit

Order matters here more than in most incidents.

1. Clean the device first. Run a full scan with reputable security software. If the infection is confirmed or you cannot be sure, reset the device and restore from a backup made before the infection. The NCSC publishes plain malware removal guidance.
2. Do not change passwords on the infected device. The new ones are captured the same way the old ones were.
3. From a clean device, change your email password first, then sign out of all sessions. The sign-out is essential — it invalidates the stolen cookies, which a password change alone may not.
4. Work through the rest in order of damage: banking, cryptocurrency, cloud storage, social media, shopping accounts with saved cards.
5. Sign out everywhere on each one. Every service that offers a "sign out of all devices" or "revoke sessions" option — use it.
6. Check for changes the attacker left: email forwarding rules, new recovery addresses, added phone numbers, connected apps, and unfamiliar devices.
7. Turn on two-factor authentication everywhere it is missing, and prefer an app or passkey over SMS.

What to do when a password is exposed in a breach covers the follow-up steps — credit freezes, monitoring, and the phishing that arrives afterwards.

Key takeaways

• Infostealers copy credentials off your device rather than guessing them.
• Session cookies are part of the haul, and a replayed session can bypass two-factor authentication.
• Password strength is no defence against this one attack, though it remains essential against others.
• Infection almost always requires running something — cracked software, fake installers, or pasted commands.
• Recovery starts with cleaning the device, then signing out of all sessions everywhere.