Explainer

What is an infostealer? Why it bypasses MFA (small-business guide)

Updated August 2026 · independent comparison · primary sources linked

An infostealer is a type of malware built to quietly harvest data from an infected device, saved browser passwords, autofill details, crypto wallets, and, most dangerously, active session cookies, then send it to the attacker, who sells it in bundles called “stealer logs.” Infostealers matter for small businesses because the stolen session cookies let attackers bypass MFA entirely, and because a single infected laptop can leak every credential saved in its browser at once.

What an infostealer takes

Saved passwords & autofill from the browser’s password store.
Session cookies / tokens for sites you’re currently logged into, the MFA-bypass vector (how that works).
System & browser fingerprint data that helps attackers impersonate your session convincingly.
Sometimes crypto wallets, files, and messaging tokens.

How devices get infected

Common routes: malicious downloads posing as cracked software, game mods or “free” tools; fake update prompts; malvertising; and phishing attachments. Well-known families include RedLine, Lumma, Vidar, Raccoon and their successors. Infections are often on personal or unmanaged devices that also log into work accounts, a blind spot for many small businesses.

Why infostealers changed the game

The shiftOld-school breaches leaked hashed passwords from one site. Infostealers leak plaintext credentials and live sessions across every site the victim uses, and the session cookies mean the attacker often doesn’t need the password or the second factor at all.

How to defend against them

Endpoint protection & patching, stop the infection at the device (the root cause).
Monitor stealer-log exposure so an infection surfaces before accounts are misused.
Invalidate sessions after any suspected compromise, not just reset passwords.
Phishing-resistant MFA (passkeys/FIDO2) and shorter session lifetimes.
Separate work and personal devices/browsers where you can.

This maps directly to the weak-control patterns in CISA/NSA/FBI advisory AA22-137A: unmanaged access and compromised credentials are the way in.

Related toolBreachTrigger is the simplest way to get an early warning when a public-company vendor, cloud provider or partner you depend on discloses a breach: it watches U.S. SEC EDGAR every ~30 minutes and alerts you the moment a company files an Item 1.05 “material cybersecurity incident” 8-K. It does not scan dark-web dumps for your own passwords, so it is not a like-for-like HIBP alternative, it solves a different problem: vendor and third-party breach early warning. See BreachTrigger → (free weekly digest; instant alerts from $199/mo).

Frequently asked questions

What is an infostealer?

Infostealer malware harvests saved passwords, autofill data, crypto wallets and active session cookies from an infected device and sends them to an attacker, who sells them in bundles called stealer logs. The stolen session cookies are especially dangerous because they can let attackers bypass MFA.

How is an infostealer different from a normal data breach?

A normal breach leaks a database (often hashed passwords) from one hacked site. An infostealer leaks plaintext credentials and live session cookies for every site the victim uses, straight from their device, so it can compromise many accounts at once and bypass MFA via stolen sessions.

How do I protect my business from infostealers?

Run endpoint protection and keep devices patched, avoid untrusted downloads, monitor stealer-log exposure, invalidate sessions after any suspected compromise, use phishing-resistant MFA (passkeys), and separate work from personal browsing where possible.