Threat intelligence · 8 min read · 4 August 2026
Infostealer malware quietly copies credentials, browser cookies and session tokens from one device, then hands an attacker a working key to accounts you thought were protected.
There is a persistent mental image of how accounts are broken into: someone hammering a login page with guesses until a weak password gives way. In many real incidents, nobody guesses anything. The password was read from a device infected earlier, packaged with everything else of value on that machine, and sold.
The tool that does this has an unglamorous name: the infostealer. It does not need to encrypt files or interrupt work. It runs, copies what it can, sends the collection away and often disappears. The consequences surface later and somewhere else, in a payroll portal, a cloud console, a supplier account or a company VPN.
An infostealer is malware built to harvest data that can be used to impersonate someone. Europol has described prominent stealer families as tools that silently extract passwords, browser information, cryptocurrency wallet data and other credentials. The malware is often disposable: execute, collect, transmit, terminate.
It is also a commodity. Stealer subscriptions and stolen-data markets separate the person who infects a device from the person who later abuses the access. A quiet infection on a contractor's home laptop can therefore become a corporate incident weeks or months later.
16%
Stolen credentials were the second-most observed initial infection vector in Mandiant's 2024 investigations.
49%
In Verizon's 2025 infostealer analysis, only 49% of a user's passwords were distinct in the median case.
The entry point often looks ordinary: a counterfeit download page promoted through search advertising, a cracked application, a malicious attachment, or a fake verification step. In the ClickFix pattern, a page claims something must be corrected and instructs the visitor to paste a supplied command into the computer. The user appears to fix a routine problem but actually starts the malware.
None of these routes requires cartoonish carelessness. An employee searching for a PDF utility and choosing the first sponsored result is behaving exactly as the attacker expects. Effective prevention needs browser controls, application allow-listing, endpoint detection and specific training about the delivery methods people are likely to meet.
The value of a stealer log is not any single item. It is the combination: saved passwords, cookies that preserve signed-in state, tokens issued after authentication, browser autofill data, wallet files and detailed information about the device. Together, these elements help a buyer reconstruct a person's digital identity without contacting them.
System context matters more than it first appears. Hostname, operating system, installed software, language and time zone help an attacker identify corporate devices and imitate a familiar fingerprint. Buyers are not only looking for the key. They want the fraudulent session to resemble the person who originally owned it.
After a successful login, an application issues a session token that tells the browser it has already proved its identity. That token is why a user can close a tab and return later without signing in again. If malware copies the token, an attacker may be able to present it from another device and continue the session.
The same principle applies to application passwords, API keys, saved VPN profiles and long-lived OAuth permissions. Each is a separate path that an ordinary password change can leave untouched.
Collections of stolen information are commonly called logs. They can be sorted by domain, application and likely value. Some buyers want consumer accounts for fraud; others look specifically for corporate access that can be resold to groups conducting business email compromise, data theft or ransomware operations.
Individuals may notice unexpected password resets, sudden sign-outs, unfamiliar account notifications, messages they did not send or browser extensions they did not install. Security teams should look for authenticated sessions appearing without a corresponding login, mailbox forwarding rules created without approval, sessions moving between impossible locations, and corporate domains appearing in credential-exposure monitoring.
Three questions expose most readiness gaps. Can you revoke a user's sessions across identity, email, VPN and major SaaS platforms within an hour? Do you know which unmanaged devices regularly access corporate systems? If credentials from your domain appear in a stealer dataset tomorrow, who receives the alert and what happens next?
Credential-exposure response checklist
Infostealers do not match the dramatic way organisations imagine an attack. There may be no visible damage and no immediate alert, only a gap between the copying of access and the consequence of its use. That gap is where defence lives. Shorter sessions, phishing-resistant authentication and rapid revocation turn time into an advantage.