In the first half of 2026, infostealer malware harvested credentials from more than 10 million devices worldwide, and the vast majority of victims had no idea the theft had happened until their bank account was empty. This is not ransomware with a countdown timer. There are no pop-ups, no obvious slowdowns, no ransom note. The malware runs quietly in the background, copies your passwords, and leaves without a trace.
Infostealer malware is software that silently captures credentials, browser-saved passwords, session tokens, and banking data from an infected device, then transmits that data to a remote attacker. The attacker's goal is not to disrupt your device but to remain undetected long enough to extract everything of value from it.
What is infostealer malware? An infostealer (also called a credential stealer or password stealer) is a category of malicious software designed to locate and exfiltrate sensitive data from an infected device. Infostealers specifically target saved browser passwords, banking session cookies, autofill data, and cryptocurrency wallet files, transmitting them to attacker-controlled infrastructure within seconds of infection.
Infostealers do not steal everything. They are built for efficiency: collect the highest-value data, compress it, and send it before detection. Banking credentials sit at the top of that value hierarchy because they convert directly to money. A valid username and password for an online banking portal is worth between $40 and $200 on underground markets, depending on the account balance, compared with $1 to $5 for general email credentials.
Session cookies are worth even more. When you log into your bank, your browser stores a session cookie that proves you are already authenticated. An infostealer that captures an active session cookie can replay it in a different browser, bypassing your password and often bypassing two-factor authentication entirely, because the session was already verified when the cookie was issued. A fresh session cookie for a high-value bank account can command $500 or more in criminal marketplaces.
"Infostealers represent one of the most significant and underreported threats to consumer financial security. The ability to harvest session tokens and bypass multi-factor authentication makes them disproportionately dangerous relative to their complexity." CISA, Phishing Guidance: Stopping the Attack Cycle at Phase One (2023, updated 2025)
Four delivery routes account for the majority of infostealer infections in 2026. Understanding each one changes how you think about your own device hygiene.
Phishing emails with malicious attachments. The attacker sends an email impersonating a bank, courier company, or government department. The attachment, often a PDF or Office file, contains a macro or embedded script that downloads and executes the infostealer silently when opened. Spear-phishing variants target specific individuals by incorporating personal details scraped from social media, making the email look genuinely legitimate.
Malvertising. Malicious advertisements appear on legitimate websites, including major news sites and video platforms, through compromised ad networks. A single click on the ad, or in some cases merely viewing the page, can trigger a drive-by download. In 2025, the FBI's Internet Crime Complaint Center (IC3) identified malvertising as the primary delivery vector for Lumma Stealer, one of the most active infostealer families currently in circulation.
Trojanised software. Cracked versions of paid software, game trainers, and "free" versions of premium tools distributed through torrent sites or unofficial forums frequently contain infostealers bundled inside the installer. The user installs what appears to be a working application while the infostealer runs alongside it.
SEO-poisoned download pages. Attackers build convincing-looking download pages for popular software, optimise them to rank in search results, and serve infostealer-laden installers to users who believe they are downloading a legitimate application. Searches for terms like "free PDF editor download 2026" or "VPN installer for Windows" have returned poisoned pages in documented incidents this year.
The data collection phase of a modern infostealer takes between 30 and 90 seconds on a typical device. That is enough time to harvest:
Infostealer malware is sold as a service on criminal forums, which means anyone willing to pay a subscription fee of $100 to $500 per month can deploy it. These are the families currently generating the most infections:
| Family | Primary targets | Notable behaviour |
|---|---|---|
| Lumma Stealer | Crypto wallets, banking, cloud accounts | Anti-VM checks, fileless delivery via malvertising |
| Vidar | Browser passwords, 2FA extensions | Uses legitimate cloud services (Telegram, Steam) for C2 traffic |
| RisePro | Banking credentials, session cookies | Bundles with cracked software; large volume of daily infections |
| StealC | Browser passwords, email, banking | Lightweight (under 70 KB); sold as a kit with a web panel |
| Atomic (AMOS) | macOS users; crypto wallets, passwords | Targets macOS specifically; increasing prevalence in 2026 |
The business model behind these families is Malware-as-a-Service (MaaS). The developers write and maintain the code; affiliates pay to access a delivery panel and receive a share of the harvested credentials. This model has lowered the barrier to entry dramatically. Attackers no longer need technical skills to run an infostealer campaign.
"The Malware-as-a-Service model has industrialised credential theft. Infostealer campaigns that previously required significant technical expertise can now be launched by anyone with a credit card and a criminal forum account." NCSC, Threat Report on Infostealers (2025 edition)
After the infostealer transmits your credentials, the attacker has a few hours to act before you notice something is wrong. Account takeover follows a consistent pattern.
The entire process from initial credential theft to completed fund transfer can take less than 90 minutes for an attacker with an automated cash-out workflow.
Infostealers are built to be invisible, but a few indicators are worth watching for:
By the time you notice most of these indicators, the theft has already occurred. The more useful approach is prevention, before the infostealer reaches the device at all.
No single measure eliminates the risk, but the following steps, taken together, remove the conditions infostealers depend on.
Stop saving passwords in your browser. This is the single most direct change you can make. Browser-saved passwords are the primary target of every major infostealer family because the decryption keys sit on the same device. A dedicated password manager like NordPass keeps your credentials encrypted in a vault protected by a master password that never touches your browser's local database, making browser-targeting infostealers ineffective against your banking credentials even if the device is compromised.
Use hardware-backed two-factor authentication for banking. Authenticator apps are better than SMS. A hardware security key (FIDO2/WebAuthn) is better still because it requires physical possession of the device to authenticate. Critically, hardware keys are immune to session-cookie replay attacks, the authentication requires the physical key to be present at login, not just a valid cookie.
Keep your operating system and browsers updated. Most infostealer delivery exploits target known vulnerabilities in browsers, PDF readers, and Office applications. Automatic updates close these gaps within days of a patch being released. In 2025, the majority of successful malvertising-based infostealer infections involved browsers that were more than two months out of date.
Use an endpoint security tool that detects infostealer behaviour. Traditional signature-based antivirus misses new infostealer variants. Behaviour-based endpoint detection, which flags processes that attempt to read browser password databases or establish suspicious outbound connections, catches novel variants before they can exfiltrate data. Windows Defender with cloud-based protection enabled provides a meaningful baseline at no additional cost.
Do not download software from unofficial sources. Cracked software and torrent-distributed installers are the easiest entry point for infostealers to reach non-technical users. Every piece of software should come from the official vendor's website or a platform with a vetted submission process. This rule applies to browser extensions as well: only install extensions from the official Chrome Web Store or Firefox Add-ons site, and review permissions before installing.
Monitor your banking credentials in breach databases. If an infostealer-harvested credential log containing your email is circulated on dark-web forums and then indexed by breach monitoring services, you will get an early warning before the attacker acts. NordPass includes data breach scanning that alerts you when your email addresses appear in known dumps, giving you a window to change affected passwords before the stolen credentials are monetised.
Log out of banking sessions when you are finished. An active session cookie is far more valuable than a harvested password. Logging out invalidates the session token immediately, so even if an infostealer captures the cookie in the same session, it will be worthless by the time the attacker tries to replay it.
Passkeys, built on the FIDO2/WebAuthn standard, are the most structurally sound defence against infostealer-based credential theft. A passkey is a cryptographic key pair: the private key never leaves your device, and it is never stored in your browser in a form that an infostealer could extract. There is no reusable password to steal. If your bank supports passkeys, switching to them eliminates the main infostealer attack vector for that account entirely.
Major UK banks including Barclays, Lloyds, and HSBC are actively rolling out passkey support in their mobile apps in 2026. Adoption in their web portals is expected to follow by Q1 2027.
Infostealers succeed because they exploit the gap between how browsers store credentials and how users assume those credentials are protected. The browser's built-in password manager is convenient, but convenience and security pull in opposite directions here. Moving your banking passwords out of the browser and into a dedicated encrypted vault, adding a second factor that cannot be bypassed with a stolen session cookie, and keeping your device software current removes the three conditions every major infostealer family depends on.
The threat is serious. The fixes are not complicated. Acting on them today takes roughly 30 minutes and reduces your exposure to infostealer-driven banking fraud from high to near-zero.