Technique

Infostealer

Also known as: Stealer Malware, Infostealer Malware

COMPROMISE

Malware designed to silently harvest saved credentials, browser cookies, session tokens, cryptocurrency wallets, and personal data from infected devices, then exfiltrate it to attackers within minutes of infection. Operating as Malware-as-a-Service (MaaS) platforms priced from $200-$250/month, infos…

Common attack flows

How it fits in a scam

This technique shows up duringCOMPROMISE

Before

After

Defense

How to defend against this

How to spot it

Unexpected login alerts from services like Google or Microsoft from unfamiliar locations or devices
Password reset emails you did not request
Two-factor authentication prompts you did not initiate
Unauthorized posts
DMs
or purchases from your accounts
Friends or contacts receiving strange messages from your accounts
Antivirus or security software mysteriously disabled or uninstalled
Notification from a breach monitoring service that your credentials appeared in a stealer log dump
Cryptocurrency wallet balances unexpectedly drained
Being logged out of accounts simultaneously across multiple services
Browser extensions you did not install
or changed homepage and search settings
Sessions appearing in account security dashboards from locations you have never visited

Tools you can use

Steps you can take

Seen in the wild

Where we’ve seen it

Commonly targets