An infostealer is a program with one job: find credentials on a machine, package them, and send them to whoever deployed it. It is deliberately boring. It does not encrypt your files, pop up a ransom note, or mine cryptocurrency in the background. Drama would get it noticed.
A typical run lasts seconds. The program wakes up, walks a list of known locations — browser profile folders, wallet directories, messaging app data, the desktop — copies what it recognises, compresses it, uploads it to a server or a Telegram bot, and in many cases removes itself. Your machine keeps working normally. That is the point.
Most infostealers are not written by the people using them. They are sold as a service: a subscription, a web panel to collect results, updates when a browser changes its encryption. That model is why there are so many of them and why the people deploying them do not need much skill. Families that have dominated at various points include RedLine, Raccoon, Vidar, StealC, Rhadamanthys and Lumma.
This is not a hypothetical class of malware. It is the subject of repeated international law-enforcement operations, which is a reasonable proxy for scale: Genesis Market, a marketplace built around stolen browser sessions, was seized in April 2023 in Operation Cookie Monster. RedLine and Meta were disrupted in October 2024 in Operation Magnus, led by the Dutch National Police with the FBI and Eurojust. Lumma's infrastructure was disrupted in May 2025 following action by Microsoft's Digital Crimes Unit and the US Department of Justice. In each case the tooling was replaced by competitors within months.
Almost none of this involves a mysterious drive-by hack. In most cases the victim installed the thing on purpose, believing it was something else.
This is the big one, and it is worth being blunt about. A cracked copy of expensive software is the ideal delivery vehicle: the user is already expecting to see antivirus warnings, is already prepared to click through them, has probably been told to disable protection first, and will run the installer with administrator rights. A "crack" that also works as advertised is even better — nobody investigates software that does what it promised.
Game cheats occupy the same niche for the same reasons, with a younger audience and the same instruction to switch protection off.
Attackers buy search ads, or manipulate rankings, for terms like a popular utility's name plus "download". The page looks like the real project's site. The installer is signed, sometimes with a certificate bought or stolen for the purpose, and may even install the genuine application alongside the stealer.
A compromised or malicious page tells you your browser or a meeting app needs updating. A newer variant, often called ClickFix, shows a fake CAPTCHA or error and instructs you to press a keyboard shortcut and paste a "verification" command into a terminal or the Windows Run box. You are not solving a CAPTCHA. You are running the installer by hand, which neatly sidesteps every protection that would have inspected a downloaded file.
No legitimate website has ever needed you to copy a command into PowerShell, Terminal or the Run box to prove you are a human, watch a video, view a document or fix an error. Not once. If a page asks, the page is the attack.
The familiar route, and still effective in a work context: an invoice, a CV, a shipping notice, a shared document. The lure quality is what varies — and lure quality is where the data-broker industry quietly contributes, which we come back to at the end.
The list is longer than most people expect, and the order of importance is not the order you would guess.
| What it takes | Why it matters |
|---|---|
| Session cookies and tokens | Lets an attacker resume a session you already logged into — usually without a password or a 2FA prompt. The most valuable item in the log. |
| Saved browser passwords | Every site you told the browser to remember, in plaintext once decrypted. |
| Autofill and saved cards | Name, address, phone, email, sometimes card numbers. |
| Crypto wallet files and seed phrases | Wallet extension data, desktop wallet files, and any text file where a seed phrase was pasted. Irreversible losses. |
| Messaging tokens | Discord, Telegram and similar — used to impersonate you to your contacts, which spreads the infection through trust. |
| Files matching patterns | Documents with names like "passwords", "wallet", "backup codes", "seed". |
| A machine fingerprint and screenshot | Sold alongside the rest so a buyer can imitate your device and location well enough to avoid triggering a security review. |
On Windows, Chrome and Edge encrypt saved passwords with a key protected by the operating system and tied to your user account. That defends against someone copying the file off your disk and reading it elsewhere. It does not defend against a program running as you, on your machine, while you are logged in — which is exactly what an infostealer is. From the operating system's point of view, the malware asking to decrypt your passwords looks like you asking.
Browser makers have pushed back. Chrome added App-Bound Encryption on Windows in 2024 to make cookie theft harder by tying the key to a higher-privileged service. Stealer developers adapted within months, and it remains an arms race. Treat "my passwords are in the browser" as a risk you are choosing, not a problem someone else has solved for you.
This deserves its own section because it is the most misunderstood thing about infostealers.
When you log in and complete 2FA, the site gives your browser a session cookie: a token that means "this browser already proved who it is, let it through." That cookie is what stops you re-entering a code on every page. If someone steals it and loads it into their own browser, the site sees an authenticated session. There is no password prompt, because they are not logging in — they are continuing a login you already completed.
This is why the standard advice, on its own, is not enough. A long unique password does not help if the cookie is taken after you used it. A TOTP code from an app does not help either. And changing your password afterwards does not reliably help, because on many services changing a password does not invalidate existing sessions unless you explicitly sign out everywhere.
The unit of trade is a log: one folder per infected machine, containing that victim's passwords, cookies, system details and screenshot. Logs are handled in bulk, sorted and filtered.
1Collection. The operator's panel receives logs automatically, often thousands at a time, tagged by country, installed software and what was found.
2Triage. Logs are searched for what buyers pay most for — corporate VPN and email domains, banking sessions, crypto wallets, cloud consoles, active subscriptions.
3Sale. Bulk logs sell cheaply, sometimes a dollar or two each, on criminal marketplaces and in Telegram channels. Individually interesting ones are priced by what the access is worth.
4Escalation. A log containing a corporate credential may be bought by an initial access broker, who verifies the access and resells it to a ransomware crew. A large number of ransomware incidents begin as one employee's home machine and one stolen session.
5Recirculation. Old logs are bundled into "combolists" and resold indefinitely, which is why the same credentials reappear in breach notifications for years.
Once a log is out, it is out. There is no mechanism to recall it, and nobody who can delete it for you — whatever a service claims. We have written about that claim directly in Can You Remove Your Data from the Dark Web? (Honest Answer). The useful response to exposure is to make the stolen material worthless: rotate it, revoke the sessions, and monitor for its use.
In rough order of how much difference each one makes.
1Stop installing cracked software, keygens and cheats. Nothing else on this list buys you as much. If cost is the obstacle, free and open-source alternatives exist for almost every category, and a free tool that is what it says it is beats a paid one that is not.
2Never paste a command you did not write. No site needs you to run anything to prove you are human or to view a page.
3Move your passwords out of the browser into a dedicated password manager, and turn off the browser's own offer to save them. Be clear about what this buys you: a manager that is unlocked on a machine actively being stolen from can also be read. What it buys is that the browser store — the first and most automated thing every stealer looks for — is empty, and that your vault can be locked, audited and rotated as a unit.
4Use 2FA everywhere, and prefer passkeys or a hardware key for email, banking and your password manager. Cookie theft can bypass a code you typed; it cannot replay a key you never transmitted. Your email account is the master key to everything else — protect it first.
5Learn where "sign out of all devices" lives on your important accounts, before you need it. This is the control that actually kills a stolen cookie, and changing your password often does not.
6Keep your OS, browser and security tooling current and switched on. The built-in protection on a modern system is genuinely decent — which is why so many infections start with an instruction to disable it.
7Keep seed phrases off the computer entirely. Written on paper, or in a hardware wallet. A seed phrase in a text file, a screenshot or a notes app is a seed phrase in the next log.
8Separate the risky machine from the important one if you cannot resist the risky software. A separate device, or at minimum a separate user account and browser profile that never touches banking or email.
Assume everything on that machine is compromised, and work in this order:
Let us be accurate about the connection, because it is easy to overstate and we would rather not.
Removing your data from brokers does not stop malware. It will not block an installer, and it will not help a machine that is already infected. Anyone implying otherwise is selling you something.
What broker data does is supply the raw material for the parts of this that depend on knowing things about you:
So the honest framing is not "delete your data and you will not get infected". It is that your exposure has two halves — what is on your machine, and what is published about you — and they multiply. You control the first with the steps above. The second is what we do.
Data brokers make you easier to target and easier to impersonate. Vigilant Privacy sends legal deletion demands on your behalf to the brokers that hold your name, address, phone and relatives, and tracks what each one does about it — for $9.95/month. It will not stop malware. It will cut the supply of details that make an attack land.
Start free — no card requiredNo signup, no card, no data kept.