Infostealer Malware

Layer 7: Application High risk

How it works

Infostealers are small malicious programs designed to grab as much valuable data as possible in seconds. They often arrive through fake software downloads, pirated programs, game cheats, malicious ads or phishing attachments. Once run, they collect passwords saved in browsers, session cookies, cryptocurrency wallets, autofill data and files, then send everything to the attacker. The whole process can finish in seconds, and some infostealers delete themselves afterwards to avoid detection.

Stolen session cookies are particularly dangerous because they can let an attacker access an account without needing the password or a multi-factor prompt. Stolen data is packaged into logs and sold on criminal marketplaces, where others buy access to specific companies. Infection on a personal home computer used for work is a common path into business systems. Antivirus alone may not catch every variant, since new versions are released frequently to evade detection.

Warning signs

• Unexpected sign-ins to accounts that use MFA
• Recently installed free or cracked software
• Security alerts about suspicious processes or scripts
• Browser sessions logged in from unknown locations
• Company credentials appearing in breach monitoring

How to defend against it

• Use endpoint detection and response on every work device
• Restrict software installation to approved applications
• Discourage saving work passwords in browsers; use a password manager
• Limit work access from unmanaged personal devices
• Use conditional access and token protection where available

If it happens to you

1. Isolate the infected device from the network
2. Reset all passwords used on the device from a clean computer
3. Revoke active sessions and tokens for affected accounts
4. Rebuild the device rather than just cleaning it