What is infostealer malware? How stolen passwords and sessions end up for sale

Category hub: Credentials, identity and exposure

In one sentence: Infostealer malware quietly copies saved passwords and login sessions from an infected computer and sends them to criminals, who sell them or use them to log in as you.

What it is

An infostealer is malware built for one job: collecting data from the device it infects. It often arrives hidden in a fake download, a cracked program, a malicious advert or a phishing attachment. It runs briefly, grabs what it can and sends it away.

The FBI and CISA describe one family, LummaC2, in an advisory. They say it can exfiltrate personally identifiable information, financial credentials, cryptocurrency wallets, browser extensions and multifactor authentication details. The package stolen from one device is called a stealer log. The word log is common usage, not a formal standard term.

How it works

Infection. A user runs a booby-trapped file or visits a malicious page.
Collection. MITRE ATT&CK describes malware reading the files where browsers keep saved logins (T1555.003) and stealing web session cookies (T1539). A session cookie keeps you logged in without a password, and MITRE notes a stolen cookie can let an attacker past some MFA checks.
Sending. The data goes to the attacker’s server, often over an encrypted channel.
Sale or use. Logs are listed on criminal markets. The FBI and CISA cite private sector figures of more than 21,000 listings selling logs from one stealer family between April and June 2024.
Log in. Buyers, including initial access brokers, use the passwords and cookies to reach email, VPNs and cloud tools. The FBI and CISA note Royal ransomware actors may use brokers who harvest VPN credentials from stealer logs.

Who it affects and how badly

Sole trader to 10 staff. One infected laptop with saved logins can mean a hijacked email account, bank and cloud storage.
10 to 250 staff. People use one browser for work and home, so a personal PC with work logins is as exposed as a work PC. Recruiters and estate agents often share accounts.
250 plus and regulated firms. Stolen VPN and admin sessions lead to ransomware or data theft, and can bypass MFA if the session token is stolen. A stolen session on a system holding personal data can be a reportable breach.

Resetting a password may not remove an attacker who holds a valid session.

Real examples

LummaC2. FBI and CISA advisory AA25-141B, published on 21 May 2025, says its indicators relate to infections from November 2023 through May 2025. It recommends phishing-resistant MFA, application allowlisting, segmentation, patching and monitoring for unusual processes.
RedLine Stealer. MITRE ATT&CK describes it as a stealer first identified in 2020 and sold as malware as a service. No victims are named.

How to detect it

Endpoint logs showing non-browser programs reading browser password or cookie stores. MITRE suggests monitoring for this.
Sign-ins that reuse a valid session from a new place or device. Microsoft Entra ID risky sign-in reports can flag some.
Staff reporting cracked software or odd downloads before a problem.
Your staff addresses or passwords appearing in a breach exposure check.

How to fix or prevent it

Remove saved passwords from browsers and move staff to a managed password manager.
Use phishing-resistant MFA for admin, finance and remote access accounts, as CISA advises for LummaC2.
Keep endpoint protection with behaviour monitoring on every device that touches work data.
Keep work logins off unmanaged personal devices.
Block unapproved software with application control.
Use conditional access and shorter sessions on sensitive systems.
If a device is infected: isolate it, rebuild it, reset passwords, revoke all sessions and tokens and rotate keys. A password change alone is not enough.
Check regularly whether staff credentials appear in known exposures.

Related terms

FAQ

What is a stealer log?
The package of data an infostealer collects from one infected device. The term is common usage, not a formal standard.

Can infostealers bypass MFA?
They can steal session cookies. MITRE notes a stolen cookie can let an attacker past some MFA checks.

Is changing the password enough after an infection?
No. Revoke sessions and tokens, rebuild the device and rotate other secrets.

Sources

How Wolfcore helps

Breachy checks whether your staff email addresses and passwords are already in known breaches and gives you the exact steps to close each exposure. See Breachy breach exposure monitoring.