Infostealer
Also known as: info stealer, infostealer malware, information stealer, stealer malware, password stealer
An infostealer is a type of malware designed to quickly collect sensitive information from an infected computer, such as saved browser passwords, session cookies, autofill data, crypto wallets, and files, then send it to criminals.
The stolen 'logs' are sold on criminal marketplaces and used to break into accounts, sometimes bypassing multi-factor authentication through stolen session cookies. While infostealers often arrive through fake software downloads or game cheats on personal devices, they've caused some of the largest corporate breaches in recent years.
Infostealer, explained at three levels
At home
An infostealer is a sneaky program that, once on your computer, grabs all your saved passwords and logins in seconds and sends them to criminals.
At work
Infostealers on employee or contractor devices can give attackers working logins to company systems, leading to major breaches.
At home
These programs often hide inside pirated software, fake game mods, or fake 'update your browser' pop-ups. Once run, they collect saved passwords, cookies, and crypto wallets, sometimes deleting themselves afterwards.
At work
Stolen session cookies let attackers skip passwords and MFA by reusing an already signed-in session. Criminals sell logs on marketplaces and Telegram channels, and initial access brokers use them to sell entry into companies.
At home
Saving passwords in your browser on a shared or poorly protected computer makes infostealers more damaging. In my opinion, a dedicated password manager and avoiding pirated software are the best personal defences.
At work
Defences include EDR on all devices accessing company resources, blocking personal devices from sensitive systems, phishing-resistant MFA, short session lifetimes and token binding, monitoring for leaked credentials, and revoking sessions quickly when infections are found.
Real-world examples
At home
Marcus's teenage son downloaded a free 'cheat' for a video game. Within hours, the family's email and streaming accounts were taken over, because an infostealer had grabbed saved passwords from the browser.
At work
Nadia is security lead at a Toronto SaaS company. After a contractor's home computer was infected with an infostealer, she revoked all of that contractor's sessions and required device health checks for anyone accessing production.
How it compares
| feature | Infostealer | Ransomware |
|---|---|---|
| Goal | Steal data and logins quickly | Lock data for payment |
| Visibility | Silent | Announces itself |
| Damage | Account takeovers, later breaches | Immediate disruption |
| Common entry | Fake downloads, cracked software | Stolen access, exploits, phishing |
Infostealers steal quietly. Ransomware strikes loudly. One often leads to the other.
For analysts
I'd treat any infostealer infection as a full credential compromise: reset passwords, revoke sessions, and check for misuse. Cleaning the malware alone isn't enough.
History & origin
Password-stealing trojans have existed since the early 2000s, and the Zeus banking trojan, first seen in 2007, stole online banking credentials at massive scale. Infostealers sold as subscriptions, such as RedLine, Raccoon, Vidar, and Lumma, spread widely from around 2020. In 2024, attackers used credentials stolen by infostealers years earlier to access customer accounts at the cloud data company Snowflake that lacked multi-factor authentication, affecting firms including AT&T and Ticketmaster; a suspect was arrested in Kitchener, Ontario, that fall. Law enforcement disrupted RedLine and META in October 2024 through Operation Magnus, and Microsoft and partners seized thousands of domains tied to Lumma in May 2025. In my view, infostealers show why personal device hygiene is now a corporate security issue.