# What is an Infostealer?

> An infostealer is malware specialized in harvesting credentials, session tokens, browser data, and other stored secrets and personal information from an infected device for resale or follow-on access.

- Canonical URL: https://yellowcube.eu/glossary/infostealer/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

Stealers are usually brief visitors: they execute, collect browser credential stores, cookies, autofill data, cryptocurrency wallets, and documents, transmit the archive, and remove themselves — sometimes before the owner notices anything. The harvested “logs” feed an underground market where access brokers resell them to operators who commit fraud or stage intrusions, including into corporate environments reached through personal accounts and saved sessions.

The downstream damage routinely outlives the infection. Stolen session cookies bypass passwords entirely, saved enterprise credentials convert a personal-device infection into a corporate foothold, and a password change alone does not invalidate tokens or warn about accounts the victim forgot were saved.

### Key points

- **Collection targets:** Browser credential and cookie stores, autofill and payment data, session tokens, files and documents, wallet data, and system fingerprints that help buyers price and target the victim.
- **Response scope:** Reset every credential saved on the device — not only the ones in use — invalidate active sessions and tokens, review account activity for reuse of the stolen material, and check whether the device held corporate or customer access.
- **Prevention:** Endpoint protection and execution control, restriction of where credentials may be stored, phishing-resistant authentication for high-value accounts, and hygiene around downloads, cracks, and unsigned utilities that carry stealers.
- **Important limitation:** Removing the malware does not undo the theft — the data is already sold or staged for use. A clean scan after the fact says nothing about which credentials were already taken, and detection of the stealer often arrives only when the stolen access is used.

### Related terms

[Malware](<https://yellowcube.eu/glossary/malware/>) · [Spyware](<https://yellowcube.eu/glossary/spyware/>) · [Keylogger](<https://yellowcube.eu/glossary/keylogger/>) · [Account takeover (ATO)](<https://yellowcube.eu/glossary/account-takeover/>) · [Session hijacking](<https://yellowcube.eu/glossary/session-hijacking/>)

### Sources

[MITRE ATT&CK T1555: Credentials from Password Stores](https://attack.mitre.org/techniques/T1555/) · [FBI IC3, 2025 Annual Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf) · [NIST SP 800-83 Rev. 1: Guide to Malware Incident Prevention and Handling](https://csrc.nist.gov/pubs/sp/800/83/r1/final)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.