An infostealer is a type of malware that copies saved passwords, browser cookies and other data from an infected device and sends it to the attacker. The stolen data can be used to reach accounts without guessing a password. It is often a first step before account takeover.
- Also Called2other namesInformation stealer · Stealer malware
- Related Terms3linked entriesInitial access broker · Dark web · Phishing
- Read Next1guide on the same topicThreat Intelligence 101
What is an infostealer?
An infostealer is malware built to collect data from the device it infects. Typical targets are passwords saved in web browsers, session cookies and other login data. The attacker receives the data and can use it to sign in as the victim.
How does it steal passwords?
MITRE ATT&CK describes how adversaries take credentials from web browsers. On Windows, they can read the browser’s stored login database and then decrypt the passwords with a system function that uses the victim’s cached logon details as the key. Other browsers keep logins in their own files in the user profile, and these can be read in a similar way. MITRE also notes that adversaries can search a browser’s memory for credential patterns, and that stolen passwords can be reused across systems and accounts to widen access.
How does it steal sessions?
MITRE says malware can take cookies stored on disk and in browser memory. It adds that cookies are often valid for a long time, even if the web application is not in use. With a stolen session cookie, an attacker can reach a web application as an authenticated user without the password. MITRE states that session cookies can bypass some multi-factor authentication protocols.
Why does it matter?
Stolen logins and sessions let an attacker enter a legitimate account, which can look like normal use. CISA notes that stealer logs can be a source of VPN credentials, and that criminals may use brokers to turn those credentials into access to a network. A work password saved in a browser on a personal computer can be stolen without any company system being touched. This is general reasoning, but it shows why the risk reaches beyond company devices.
How do you reduce the risk?
MITRE lists these mitigations for browser credential theft and cookie theft:
- Weigh the risk of storing credentials in web browsers, and teach users to avoid it.
- Keep browsers and password managers updated.
- Restrict malicious web content and limit third-party cookies and browser extensions.
- Regularly delete persistent cookies and keep cookie lifetimes short.
- Use hardware-based tokens and conditional access that limits sign-ins to enrolled devices.
For detection, MITRE suggests watching for reads of browser credential stores, odd access to browser process memory, unusual token reuse and sign-ins from strange locations.
Is an infostealer the same as a keylogger?
Not exactly. A keylogger records what a person types. An infostealer, as described here, mainly takes data the device already holds, such as saved passwords and cookies. Some malware can do both.
Is a stealer log the same as a data breach?
No. A stealer log comes from one infected device. A data breach is an incident at an organization. Both can expose logins, and they can lead to the same account takeover.
Related pages in the Knowledge Hub
Sources
- MITRE ATT&CK: How adversaries steal credentials from web browsers, with mitigations and detection.
- MITRE ATT&CK: How session cookies are stolen and used, including bypassing some MFA, with mitigations.
Also Called.
- NameInformation stealer
- NameStealer malware
Questions.
-
What is an infostealer?
An infostealer is a type of malware that copies saved passwords, browser cookies and other data from an infected device and sends it to the attacker, who can then sign in as the victim.
-
How does an infostealer steal passwords and sessions?
MITRE ATT&CK describes adversaries reading a browser's stored login database and decrypting the passwords. Malware can also take cookies stored on disk and in browser memory, which can let an attacker reach a web application without the password.
-
Why are infostealers a risk for companies?
Stolen logins let an attacker enter a legitimate account, which can look like normal use. CISA notes that stealer logs can be a source of VPN credentials that criminals turn into network access.
-
How do you reduce the risk of infostealers?
MITRE lists mitigations such as weighing the risk of storing credentials in browsers, keeping browsers updated, keeping cookie lifetimes short, and using hardware-based tokens and conditional access limited to enrolled devices.
In Our Research
- 1 RedLine Stealer Malware Was Distributed Through the Corporate Social Media Accounts September 2022
- 2 Top 3 Stealer Malware Activity Research March 2022
- 3 Combolists, stealer logs and credential dumps explained October 2026
- 4 ENISA 2026: ClickFix, Smishing and Phishing Kit Trends October 2026
- 5 How to triage a leaked password alert October 2026
- 6 Your Identity Program Was Built for People. Non-Human Identity Is a Growing Way In. September 2026