The alert arrives days after the cleanup. You already wiped the laptop, changed your email password, and switched on two-factor authentication. Then a login notification appears from a city you have never visited, and the account locks you out before you can react. Nothing about that sequence is contradictory. Infostealers rarely sit around watching you type. They copy the part of your browser that proves you are already logged in, then vanish.
What Infostealers Actually Take
An infostealer is narrow-purpose malware. It is not trying to encrypt your files or hold your screen hostage. It wants data that is small, portable and easy to resell. Within seconds of running, a typical stealer sweeps:
- Saved usernames and passwords from Chrome, Edge, Firefox and other browsers
- Session cookies and OAuth tokens for every site where you were signed in
- Autofill entries: names, addresses, phone numbers, card details
- Cryptocurrency wallet extensions, desktop wallet files and seed phrases left in Documents
- Login tokens for Discord, Telegram, Slack and similar apps
- VPN profiles, SSH keys, FTP logins, database passwords and .env files from developer folders
- Sometimes a screenshot of the desktop or a list of installed programs
The output is packed into a "log" and sold on underground forums or fed into automated tools. A buyer does not have to guess your password. The log hands over a working, already-authenticated session, along with enough personal detail to make the follow-up phishing message sound believable.
Why a Stolen Cookie Beats a Stolen Password
A password is a key you use at the door. A session cookie is the wristband you get after the bouncer checks it. Once the server has verified your password and your second factor, it issues a cookie so it does not have to ask again on every page load. Send that cookie back, and the server treats the request as you, because as far as it can tell, it is you.
That is the entire trick. Two-factor authentication protects the login event, not the session that follows it. If the cookie is lifted after you signed in, the attacker never sees a prompt, never needs your code, and often never trips an alert. Cookies marked as "remember me" can stay valid for weeks or months.
What pass-the-cookie looks like in practice
An attacker loads the stolen cookie into their own browser using developer tools or a small extension, or replays it through a scripted browser. Some services check IP address, device fingerprint or user-agent and may raise a challenge. Plenty do not, or only notice later. This is also why changing your password is sometimes not enough on its own: whether active sessions die with the old password depends entirely on how that particular service handles revocation.
How the Infection Usually Arrives
Stealers spread through mundane channels, and they are usually dressed up as something you wanted:
- Cracked or "free" versions of paid software, key generators and patched installers
- Search ads and SEO-poisoned pages pointing to lookalike download sites
- Fake "verify you are human" prompts that instruct you to paste a command into the Run dialog
- Links in YouTube descriptions, Discord messages, Telegram groups and comment threads
- Malicious browser extensions and fake PDF-viewer or codec "updates"
- Email attachments and links to cloned login pages that drop a payload in the background
The execution window is short. A stealer can run, collect everything, upload it and exit in under a minute, which is why "I didn't notice anything odd" is the most common thing victims say.
Clean the Machine Before You Change Anything
Order matters more than speed here. If the malware is still present, every new password you type is simply harvested again, along with the fresh session cookies that come with it. Reinstalling the operating system from external media is the only method you can fully trust. A thorough antivirus scan is a reasonable stopgap, but rootkits, injected browser extensions and tampered system files can survive it.
If you cannot rebuild right away, do not sign in to anything important from that device. Use a different, known-clean computer or your phone to start recovery. And be honest about scope: if the infected machine was also used for work, tell your IT or security team early. They would rather rotate credentials than investigate a breach three weeks from now.
The Recovery Order That Actually Works
- Stop using the infected device for anything account-related until it is rebuilt.
- Secure your email first. It is the reset hub for everything else. Check forwarding rules, filters, recovery address, recovery phone and app passwords, then sign out of all sessions and change the password.
- Hunt for persistence on every important account. Look for added MFA devices, connected apps and OAuth grants, active sessions, and trusted devices. Remove anything you do not recognise.
- Change passwords from the clean device, using a password manager so each one is long and unique. Never reuse the old pattern.
- Re-enrol MFA with an authenticator app or a hardware key. Text-message codes are the weakest option and can be intercepted.
- Handle money separately. Bank, card, payment and crypto accounts get their own pass. If a seed phrase or private key was exposed, move funds to a newly created wallet rather than trusting the old one.
- Warn the people around you. A short message to contacts explaining that your account was compromised helps them spot the fake request for money that usually follows.
Damage That Outlasts the Password Change
Sessions are only one layer. Attackers who get a few minutes inside an email account commonly set up a forwarding rule that quietly copies incoming mail to an address they control, or add an app password that keeps working after a reset. OAuth grants are another favourite: a "connected app" you approved months ago can retain access even when your password changes, which is why you should review third-party access rather than just your login history.
There is also the slower problem. Your data is now a product, and it will be used in targeted phishing for a long time. Expect messages that quote your real address, employer or partial card number. If money has already moved, contact your bank's fraud line using the number printed on your card, and for anything involving large sums, a business account or a legal dispute, bring in a qualified professional rather than working it out alone.
A Short Checklist for the First Day
- Rebuild the device, or take it offline until you can
- Email accounts: password, MFA, forwarding rules, app passwords, active sessions
- Password manager: rotate the master password from a clean device
- Banking, card and crypto accounts: passwords, alerts, transaction review
- Other logins: password change plus "sign out everywhere"
- Review connected apps, browser extensions and saved payment methods
- Note the date and what you changed, so future oddities have context
Assume the data is gone. The goal after an infection is not to recover what was taken, but to make sure the stolen copy stops being useful.
Do the boring parts properly, in the right order, and most of these incidents end as a bad week rather than a bad year.
Photo: StockSnap / Pixabay
