A large share of the credentials appearing in criminal markets today did not come from a corporate breach. They came from individual machines infected with infostealer malware, which runs briefly, harvests everything of value, and exits.

What they take

  • Passwords saved in browsers, which is most people's primary password store.
  • Session cookies and authentication tokens — the most valuable item, because they represent an already-authenticated session.
  • Cryptocurrency wallet files and browser extension data.
  • Autofill data: addresses, card details, personal information.
  • Screenshots, system details, and sometimes files matching particular patterns.

Why stolen cookies defeat MFA

Multi-factor authentication protects the login. A stolen session cookie skips the login entirely — the attacker imports it and is already inside the authenticated session. This is why "I had MFA enabled" does not rule out account takeover, and why revoking sessions matters as much as changing passwords after an infection.

How infection happens

  • Cracked software, key generators, and game cheats — historically the largest single vector.
  • Fake installers for legitimate software promoted through search advertisements.
  • Malicious attachments and links in phishing, including fake job descriptions and invoices.
  • Compromised browser extensions that update into something malicious.
  • Fake CAPTCHA or "fix this error" pages that instruct you to paste a command into a terminal or run dialog.

What to do after an infection

Assume everything on that machine is compromised. From a different clean device, change passwords starting with email, then banking, then everything else of value. Revoke active sessions everywhere — this step is skipped most often and is what allows attackers to retain access despite new passwords. Then rebuild the infected machine rather than trusting a cleanup, particularly if credentials or crypto were involved.

Reducing exposure

Use a password manager rather than browser-saved passwords, keep systems and browsers updated, avoid pirated software entirely, and be sceptical of any instruction to paste a command you do not understand. For businesses, the single highest-value control is ensuring that a personal machine infection cannot become a corporate breach: no shared credentials, phishing-resistant MFA, and short session lifetimes on sensitive systems.