An infostealer is malware designed to covertly extract sensitive data (opens in new tab) from an infected device, including saved passwords, session cookies, autofill and payment data, and cryptocurrency wallets, then exfiltrate it to attacker infrastructure (opens in new tab). It harvests whatever the device already stores in a single automated pass, completing the theft (opens in new tab) in seconds, whereas a keylogger has to wait for the user to type credentials.
Criminals call the packaged output from one infected device a stealer log.
How infostealers work
ClickFix, a social engineering technique that tricks users into pasting malicious commands into their own systems, became the most common initial access technique Microsoft observed in 2025, at 47% (opens in new tab) of cases.
A fake error message or CAPTCHA prompt tells the user to paste clipboard contents into the Windows Run dialog, which executes a malicious PowerShell process (opens in new tab) that installs the stealer. This path is well documented in Lumma Stealer intrusions, where attackers pair ClickFix with fake CAPTCHA lures (opens in new tab).
Poisoned search ads (opens in new tab) for queries like "Notepad++ download" route users to cloned vendor sites (opens in new tab), and attackers have cloned and impersonated GitHub repositories (opens in new tab) for security tooling, crypto wallets, and developer utilities.
Once running, the malware profiles the host and decrypts browser credential databases, then copies cookies, autofill records, and wallet files. LummaC2, for example, steals cryptocurrency wallet data first and exfiltrates it as a compressed archive to its command-and-control server before harvesting browser logins, history, and cookies.
Exfiltration runs over HTTP POST to C2 servers or directly through Telegram's bot API (opens in new tab). Many variants then delete themselves (opens in new tab) to hinder investigation.
The stealer log then enters a mature criminal economy, surfacing on marketplaces such as Russian Market or in Telegram channels within minutes of compromise. Developers rent out the builder and a web panel for centralized log collection, with subscription tiers that run from entry-level access to source-code packages.
Separate affiliates called traffers buy the build and run the lure campaigns themselves, so infections from many independent operations get attributed to a single family. Initial access brokers buy logs containing VPN, RDP, and SaaS credentials, verify the access, and resell it to ransomware operators and fraud crews.
Why infostealers are hard to stop
Many variants are non-persistent by design. They run, harvest, and self-delete in seconds, leaving few artifacts for endpoint tools, so the first sign of compromise often surfaces on a criminal market where the data is listed for sale.
In Verizon's 2025 breach data, 46% (opens in new tab) of compromised systems holding corporate logins in infostealer dumps were non-managed devices that mixed personal and business credentials, pointing to exposure through bring-your-own-device programs or out-of-policy use of corporate machines.
Infostealers also take session cookies straight from the browser, which defeats controls teams assume are protective. Stolen cookies let an adversary act as an authenticated user without needing credentials (opens in new tab) and bypass multi-factor authentication (opens in new tab).
Stolen refresh tokens compound the problem: they silently mint new session cookies long after responders revoke the original and reset the password, and enterprise refresh tokens can stay valid well beyond the response window, so one token can outlast the incident response cycle meant to close the account.
Investigators documented a financially motivated campaign in which credentials harvested years earlier still authenticated (opens in new tab) to enterprise cloud accounts.
The malware-as-a-service ecosystem also absorbs enforcement pressure. Europol and Microsoft disrupted Lumma Stealer (opens in new tab) in May 2025, yet the operation rebuilt its infrastructure (opens in new tab) within weeks while Vidar and Acreed moved quickly to fill the gap (opens in new tab).
What infostealers steal
A single harvest covers several categories of data from one device:
- Credentials: usernames and passwords that browsers store, plus VPN and FTP client logins.
- Session cookies and tokens: active authentication material that lets an attacker resume a logged-in session and sidestep MFA.
- Autofill and payment data: names, addresses, form data, and credit card details the browser retains.
- Cryptocurrency wallets: desktop and browser-extension wallets such as MetaMask, Electrum, and Binance.
- Files and messaging tokens: documents pulled from the local filesystem, plus Discord tokens and Steam files that enable takeover of chat and gaming accounts.
- System fingerprint: IP address, geolocation, hardware specs, and software inventory that criminals use to emulate the victim's device, plus a desktop screenshot of the session.
How to defend against infostealers
Prevention starts at execution. Application controls (opens in new tab) that limit which software can run, paired with admin credentials for installation, narrow what a pasted command can install. Group policies that disable browser credential (opens in new tab) and cookie storage shrink what an infection can harvest, and shorter token lifetimes narrow the replay window.
Identity controls close the session gap. FIDO/WebAuthn is the phishing-resistant authentication (opens in new tab) standard deployable today, and Conditional Access policies that reject replay from unmanaged devices blunt stolen-token attempts. After a confirmed compromise, incident response (opens in new tab) must revoke every session and refresh token, review OAuth grants, and reset MFA. A password reset alone leaves the attacker's tokens valid.
Stealer-log monitoring (opens in new tab) reaches exposure that endpoint tools miss, watching the criminal channels where logs surface so teams can revoke access before exploitation.
Training must teach employees (opens in new tab) not to execute commands (opens in new tab) copied from website prompts. And because impersonation underpins the most prevalent delivery paths ( cloned download pages (opens in new tab), poisoned ads, spoofed repositories), executing takedowns (opens in new tab) against that infrastructure cuts off infections at the source.
How Doppel helps
Doppel is the AI-native Social Engineering Defense (SED) (opens in new tab) platform that unifies Digital Risk Protection (opens in new tab) (DRP) and Human Risk Management (opens in new tab) (HRM) to dismantle infostealer delivery infrastructure.
Within Doppel Brand Protection, agentic AI (opens in new tab) uses multi-channel detection (opens in new tab) to find the spoofed repositories and cloned pages behind fake downloads and CAPTCHA lures, correlates those signals through the Doppel Threat Graph (opens in new tab) into one campaign view (opens in new tab), and executes takedowns at scale while analysts handle complex escalations.
The platform also turns a detected impersonation into a phishing simulation (opens in new tab) built on live ClickFix and fake-download lures, linking external detection to internal training. Request a demo (opens in new tab) to map the infostealer infrastructure targeting your brand and take it down.
Frequently asked questions about infostealers
What is an infostealer?
An infostealer is malware that covertly extracts stored data from an infected device, including browser-saved passwords, session cookies, autofill and payment details, and cryptocurrency wallets, and sends it to attacker-controlled infrastructure. It is a category of Trojan and does not self-replicate the way a virus or worm does. Many variants delete themselves after exfiltration, so victims often stay unaware until the stolen data appears for sale on criminal marketplaces.
What is the difference between an infostealer and a keylogger?
A keylogger records keystrokes as the user types, so it has to stay resident on the device before it captures anything useful. An infostealer works retrospectively: it pulls credentials, cookies, and wallets that browsers and applications already store, in one automated pass, then typically exits and self-deletes. Keyloggers need persistence and dwell time; infostealers need neither, which is why infections are so hard to catch on the endpoint.
What is an infostealer in cybersecurity?
Security teams classify infostealers within a credential-theft category (opens in new tab) because the malware takes access without damaging systems. The output from each infected device is a stealer log: captured passwords, folders of browser cookies and wallet data, saved autofill records, system details such as IP address and hardware, and a desktop screenshot. Criminals sell logs on underground marketplaces like Russian Market or share them through Telegram channels. Attackers can replay the session cookies inside a log to bypass multi-factor authentication.
What is an example of an infostealer?
Lumma Stealer (LummaC2) is among the most documented examples, the subject of a joint FBI and CISA advisory and a May 2025 infrastructure disruption by Europol and Microsoft before the operation rebuilt within weeks. After that takedown, Acreed and Vidar surged to fill the vacuum on markets like Russian Market, while Atomic Stealer (AMOS) leads infostealer activity on macOS. Affiliates rent most variants by subscription and handle distribution, though some newer families run as private operations with restricted access.