Infostealers: how one browser session becomes a breach

Most people assume that if an attacker gets their password, multi-factor authentication saves them. Usually true. But there is a category of malware that does not bother with your password at all — it steals the proof that you already logged in.

What a session cookie actually is

When you sign in to a website and tick "remember me", the site hands your browser a small token called a session cookie. From then on, your browser shows that token instead of logging in again. That is why you are not asked for your password every time you open your email.

The token is the login. If someone copies it into their own browser, the website sees a user who has already authenticated — password accepted, MFA satisfied, all of it. No second factor is requested, because as far as the service is concerned, that step already happened.

How the malware gets in

Infostealers are not sophisticated intrusions. They are ordinary downloads that someone ran on purpose. The common routes:

• Cracked software, game cheats, and "free" versions of paid tools.
• Fake installers for popular apps, promoted through search ads that sit above the real result.
• Links and attachments in messages about job offers, invoices, or copyright complaints.
• Malicious browser extensions that ask for permission to read data on every site.
• Instructions telling you to paste a command into a terminal or Run box to "fix" something or prove you are human.

Once it runs, it works fast — often seconds. It copies saved passwords, session cookies, autofill data, cryptocurrency wallet files and sometimes a screenshot, packages them, sends them out, and frequently deletes itself.

Why it matters to you

The scope is wider than people expect. Browsers accumulate sessions for dozens of services, and personal and work life are rarely cleanly separated. One infected home machine where someone checked their work email can be enough. Stolen credential sets are bought and sold in bulk, so the person who infected you is often not the person who eventually uses the data — which is why the consequence can arrive weeks or months later.

Red: why attackers love this

No exploit development, no clever intrusion. The victim installs it themselves. The output is a tidy bundle of valid, already-authenticated access to many services at once, and using a stolen session looks far more like normal activity than a brute-force attempt ever would.

Blue: what actually stops it

1. Never run software from an ad or a cracked download. This single rule removes most infostealer infections. When searching for software, scroll past the promoted results to the real vendor site, or use the official app store.
2. Never paste a command you do not understand. No legitimate website, CAPTCHA or support process asks you to paste text into PowerShell, Terminal or the Run dialog.
3. Stop storing passwords in the browser. Use a dedicated password manager with its own encryption and a separate unlock. Browser password stores are the first thing these tools read.
4. Sign out of things you are not using. A session that does not exist cannot be stolen. Shorter session lifetimes are a genuine, if slightly annoying, control.
5. Audit your browser extensions. Remove anything you do not actively use, especially anything with permission to read and change data on all sites.
6. Keep work on work devices. The unmanaged home laptop is the usual entry point.

If you think you ran one

Order matters here, and the usual instinct — change your password — is not actually first.

1. Disconnect the device from the network.
2. From a different, clean device, sign out of all sessions everywhere on your important accounts. If you skip this, the attacker keeps the cookie and your new password changes nothing.
3. Then change passwords, starting with email, then anything financial, then everything else.
4. Check each account for added MFA methods, new recovery addresses and mail forwarding rules.
5. Assume the infected machine is untrustworthy. Rebuilding it is the honest answer; running a scan and hoping is not.
6. Tell your IT or security team if any work account touched that device.