Browsers & Accounts · How Accounts Get Stolen · Lesson 2 of 5

Info-Stealers

Malware that grabs saved passwords, cookies and wallets, and how it gets in.

Grab everything and run

An info-stealer is a kind of malware built to copy your private data and send it to criminals. It usually works fast and quietly. Many run for only a few seconds, then delete themselves. You may never see a thing.

What does it take? Mostly the things your browser and apps remember for you.

• Saved passwords stored in the browser.
• Session cookies, the sign-in wristbands from the last module. These let thieves skip your password and two-step.
• Saved card details and autofill, like your address and phone number.
• Crypto wallets. A crypto wallet is an app or browser extension that holds digital money. Stealers look for its files and secret recovery words.
• Logins for game launchers, chat apps and email programs.

The stolen bundle is called a log. Criminals sell logs online, often cheaply and in huge numbers. The buyer may be a different person from the one who infected you. That is why a takeover can happen days or weeks later.

How big is this? It is one of the most common kinds of malware today. In May 2025, Microsoft said it had found more than 394,000 Windows computers infected with one stealer, called Lumma, in just two months. Microsoft and law enforcement then took down much of the network behind it. Security reports suggest other stealers quickly filled the gap, so the problem has not gone away.

Info-stealers hit Windows most, but Mac stealers exist too. They often pose as a popular app and ask for your Mac password in a fake box.

The big lesson: anything your browser remembers, a stealer can try to take. A password manager with its own lock is a safer place for passwords than an unlocked browser. Even so, the best defense is never letting the stealer run.

How stealers get in, and what to do

Almost every info-stealer needs you to run it. So criminals work hard on the bait. Here are the most common tricks.

• Cracked games and software. "Cracked" means a paid program changed to run for free. Free downloads of paid games, mods and cheats are a favorite hiding place.
• Fake tools. Free "skin generators", "FPS boosters", fake AI apps and fake updates. Some arrive through ads at the top of search results, or in links shared on Discord and YouTube.
• Fake CAPTCHAs. A CAPTCHA is a check that you are a person, like ticking "I'm not a robot". The fake kind says to press some keys, paste a command, and press Enter. That pastes and runs the stealer. A real CAPTCHA never asks you to open a command box or Terminal.

You learned to spot fake download buttons and fake commands earlier. The same rules apply here. Get software only from the maker's site or an official app store.

What if you think you ran one?

1. Disconnect the computer from the internet to stop more data going out.
2. From a different, clean device, change your email password first, then other important ones.
3. Sign out all sessions on each account, so stolen cookies stop working.
4. Run a full scan, or get help cleaning or resetting the computer.
5. If you hold crypto, move it to a new wallet with new recovery words from a clean device. The old words may be stolen.
6. Tell your bank if cards were saved in the browser.

Changing passwords on the infected computer can hand the stealer your new ones too.