Malware · · 4 min read
How infostealers steal your sessions, and why a new password isn’t enough
Infostealer malware takes the cookies that keep you signed in, so attackers can skip your password and your two-factor code. How it works and how to recover properly.
Most advice about account security is about passwords. But a whole category of malware, called infostealers, is built to skip the password entirely. It takes the thing that keeps you signed in, and with it, an attacker can open your accounts as if they were you, two-factor authentication and all.
What an infostealer takes
An infostealer is a small program that runs once, grabs what it can, and sends it to the attacker, often within seconds. Microsoft, which led a legal action against Lumma Stealer in May 2025, described it as stealing “passwords, credit cards, bank accounts, and cryptocurrency wallets.” The typical haul is:
- passwords saved in your browser
- session cookies, the small tokens that keep you signed in
- autofill data such as addresses and card details
- crypto wallet files, and sometimes chat app tokens
The stolen bundle, often called a “log,” is then sold or traded.
Why cookies matter more than passwords
When you sign in to a site and pass the two-factor check, the site gives your browser a session cookie. From then on, the cookie is your sign-in. Google’s Chrome team put it plainly in April 2026: because cookies often have long lifetimes, attackers can use stolen ones “to gain unauthorized access to a user’s accounts without ever needing their passwords.”
That’s why victims are often confused: “I had two-factor on, and they still got in.” They didn’t beat your two-factor. They took the result of it.
How it gets onto computers
Infostealers usually arrive because someone was tricked into running them:
- Cracked software and game cheats. AhnLab’s August 2026 report found stealers like Remus, Vidar and LummaC2 being spread as cracks and keygens, promoted through search results and file-hosting sites.
- Fake “verify you’re human” pages that ask you to paste a command. We wrote about this trick, ClickFix, separately.
- Malicious ads and phishing emails with attachments.
Takedowns help, but they don’t end it. Microsoft says it identified more than 394,000 Windows computers infected with Lumma between March and May 2025 and, with law enforcement, took down or blocked about 2,300 of its domains. More than a year later, AhnLab’s July and August 2026 reports still list LummaC2 among the stealers being actively spread.
What browsers are doing about it
Two changes are worth knowing about:
- App-Bound Encryption (Chrome on Windows, since mid-2024) makes it harder for other programs to read Chrome’s cookies. It raises the cost for attackers; it doesn’t stop malware outright.
- Device Bound Session Credentials (public in Chrome 146 on Windows, macOS next) tie a session to a hardware key on your device. Cookies copied to another machine quickly expire and become useless. Sites have to add support for it, and Google says that where it’s deployed, it has seen a significant drop in session theft.
Neither makes an infected computer safe. They make what’s stolen worth less.
If you think you’re infected
The order matters, because changing passwords on an infected computer can hand over the new ones too.
- Clean the device first. Run a full scan; if anything is found, or you’re unsure, back up your files and reinstall.
- From a clean device, change passwords, starting with your email, then banking, then accounts saved in that browser.
- Sign out of every session. This is the step people skip. Use each service’s “sign out of all devices” option, or remove unknown devices in its security settings. That kills stolen cookies.
- Review recovery options. Check that the recovery email and phone number on your important accounts are still yours.
- Switch to passkeys where you can. They can’t be typed into a fake site, and they aren’t saved anywhere a stealer can read as a reusable password.
Sources
- Microsoft On the Issues, Disrupting Lumma Stealer: Microsoft leads global action against favored cybercrime tool, May 21, 2025
- Google, Protecting Cookies with Device Bound Session Credentials, April 9, 2026
- Google Online Security Blog, Improving the security of Chrome cookies on Windows, July 2024
- AhnLab ASEC, July 2026 Infostealer Trend Report
- AhnLab ASEC, August 2026 Infostealer Trend Report
New posts, by email.
About once a month. Plain-language privacy notes, nothing else. I never share your address.