Threat Explainers · 6 min read
What Is an Infostealer and Why Is It the Threat That Matters?
Infostealers are now the dominant consumer malware family. They run briefly, take everything worth taking, and leave — often without any visible symptom.
Published 2026-08-09 · Last updated 2026-08-09
What they steal
Saved browser passwords, autofill data, cryptocurrency wallets, messaging tokens and — most damaging — session cookies, which let an attacker resume a logged-in session without the password.
Why session theft defeats 2FA
A stolen session cookie represents an already-authenticated session, so no password and no second factor is requested. This is why 'my password was strong' offers no protection here.
How they arrive
Cracked software and game cheats, fake installers advertised at the top of search results, and malicious attachments. The lure is almost always a download the victim went looking for.
What to do if one is found
Assume every credential stored in the browser is compromised. From a different clean device: change passwords, sign out of all sessions everywhere, revoke connected apps, and re-check account recovery settings and mail forwarding rules.
- Change email and banking passwords first — email is the reset path for everything else
- Use the sign out everywhere option to invalidate stolen session cookies
- Review OAuth-connected apps and remove anything unfamiliar
- Check mailbox rules and forwarding addresses you did not create
Frequently asked questions
- Is it safe to keep passwords in my browser?
- A dedicated password manager with a separate master password is meaningfully safer, because browser credential stores are exactly what infostealers target first.
- Would I notice an infostealer?
- Usually not. They are designed to run once and exit, which is why prevention and post-incident credential rotation matter more than symptom-watching.