Infostealer: what it is and how to tell if you're infected

You download a "crack" for a program, or click a CAPTCHA check that asks you to paste a command into Windows. Nothing happens, the program opens fine and life goes on. Three days later, someone gets into your email, your Instagram and your brokerage account without guessing a password and without needing a 2FA code. The culprit is often an infostealer: malware that doesn't want to wreck your PC, only to empty your browser.

What an infostealer is

What is an infostealer?

An infostealer is malware built to steal data from a device and send it to an attacker's server: passwords saved in the browser, session cookies, tokens, autofill data and cryptocurrency wallets.

It works fast and almost always silently. It runs for a few minutes, collects what matters, ships the package (the "logs," in criminal jargon) and often deletes itself. The scale is large: Microsoft counted more than 394,000 Windows computers infected by Lumma Stealer alone between March and May 2025, and that number backed the joint action with the DOJ and Europol that took down about 2,300 domains of its infrastructure. These tools are sold as malware-as-a-service, including on Telegram channels, so a criminal with no technical skill can run one.

How an infostealer reaches your PC

It is almost never a sophisticated technical flaw. It is social engineering. The most common paths, according to Microsoft itself and coverage from Bleeping Computer and The Register:

• Cracks, keygens and "activators": pirated software that really does open, but carries the stealer along.
• Fake game and movie downloads: the installer is the malware.
• ClickFix: a page pretends to be a CAPTCHA or a browser error and tells you to press Win + R, paste a command and hit Enter. You run the command yourself, so antivirus rarely blocks it on the spot. SentinelOne describes campaigns of this kind delivering Lumma and other stealers.
• Fake ads and search results for well-known programs, plus malicious Chrome extensions.

What it steals (and why 2FA doesn't save you)

The main target is the browser profile, where saved passwords and session cookies live. The cookie is the "badge" that keeps you logged in: whoever copies it gets into the account with no password and no code. That is exactly what I explained in session cookie theft. The stolen passwords, in turn, feed credential stuffing attacks against every other service where you reused the same password.

Signs you may be infected

How do I know if my PC has an infostealer?

The most reliable sign is not on the PC, it is in your accounts: logins from places and devices you don't recognize, and "new sign-in" emails when you didn't log in. On the computer, the stealer usually leaves little trace.

• Login alerts from an unknown device or city, even with 2FA on.
• An account that "logs itself out" or asks you to re-authenticate for no reason.
• Messages sent from your WhatsApp, Instagram or email that you didn't write.
• Odd activity in a brokerage, exchange or crypto wallet.
• You ran a crack, an installer of doubtful origin, or pasted a command from a "verification" site in the last few days.
• Your email showing up in breach checks. You can verify it in how to check if your email was leaked.

For a general check of the machine, see the signs that your PC was hacked.

What to do if you suspect an infection

Order matters. Changing passwords before cleaning the machine is pointless: if the stealer is still active, it steals the new password too.

1. Use another, clean device (your phone, for example) for everything that follows.
2. Disconnect the infected PC from the internet and run a full scan with Microsoft Defender (offline mode) or a trusted anti-malware tool. If there is real doubt, wiping and reinstalling Windows is the safest option.
3. Revoke active sessions on email, social media, bank and brokerage ("sign out of all devices"). This invalidates stolen cookies.
4. Change passwords, starting with email and bank, always from the clean device, and only then bring the sanitized PC back online.
5. Review recovery methods, passkeys and 2FA on each account, because the attacker may have registered their own.
6. Tell your bank if there is any sign of financial access.

How to lower the risk day to day

• Don't save passwords in the browser. Use a dedicated manager such as Bitwarden, with a unique password per service.
• Prefer passkeys and app-based or hardware-key 2FA where possible. They don't eliminate cookie theft, but they greatly reduce what a password alone hands over.
• Never paste into Run or Terminal a command a website told you to copy. No legitimate CAPTCHA asks for that.
• Download software only from the vendor's official site; distrust the first Google ad.
• Keep the system and browser updated and antivirus on.
• Use a standard user account day to day, without administrator privileges.

The bigger lesson

The infostealer shows that the browser became the vault of your digital life, and the vault opens on its own for anyone who manages to run code on your machine. Security here is less about tools and more about habit: don't run what you don't understand, don't keep everything in one place, and assume that if something leaks, the account must still be protected by another layer. To see the other side of this story, what happens after the stolen password circulates, read about how to protect your accounts against credential stuffing.

Sources: Microsoft On the Issues (action against Lumma Stealer), The Hacker News, The Register and SentinelOne (ClickFix).