Infostealer malware: how to protect your business passwords
Most business account takeovers no longer start with someone guessing a password. They start with a program on a computer quietly copying every password the browser has saved, together with the "stay signed in" cookies that let a website remember you. That program is called an infostealer. Within minutes of it running, a criminal can have your email, your website admin, your accounting login and your social media, without ever seeing a login screen.
This guide explains how infostealers work, why the usual advice of "just change your password" is not enough, and what to do to keep them out, and to recover properly if one gets in.
What an infostealer takes
An infostealer is malware built to collect credentials and send them to its operator. Microsoft's analysis of one widespread family, Lumma, and Eurojust's announcement of the takedown of two others, RedLine and META, describe the same haul:
- usernames and passwords saved in the web browser
- session cookies, which keep you signed in to websites
- saved form data (autofill), such as names, addresses and phone numbers
- cryptocurrency wallet data
- documents and other files from the computer
According to Eurojust, the operators sold what they collected to other criminals through online marketplaces. The person who infected your computer is often not the person who later logs in to your accounts. A stolen login can be resold and reused for years: Mandiant found that credentials used in a series of large business data thefts in 2024 had been stolen by infostealers, some as far back as 2020, often from personal computers used for gaming and pirated software.
This is not a niche problem. Microsoft counted more than 394,000 Windows computers infected with Lumma alone in two months of 2025.
How it gets onto a computer
Microsoft lists the common routes:
- Pirated and "cracked" software, such as free versions of paid programs, game cheats and key generators from file-sharing sites.
- Fake software adverts. A search for a well-known free program shows an advert at the top that leads to a lookalike download site.
- Phishing emails with attachments or links dressed up as invoices, bookings or delivery notices.
- Compromised legitimate websites that push a download without you asking for one.
- Fake "verify you are human" pages. The page claims to check that you are not a robot and asks you to press a key combination, then paste a command into the Windows Run box, Terminal or PowerShell. Microsoft calls this technique ClickFix. No real security check ever asks you to paste a command into your computer.
There have also been reported cases of a trusted browser extension being taken over and updated with code that stole session cookies, so even familiar add-ons deserve some scepticism.
Why changing your password is not enough
When you log in to a website, it gives your browser a session cookie so that you do not have to log in again on every page. An infostealer copies those cookies. Google explains the consequence plainly: cookie theft happens after you have logged in, so it gets past two-factor authentication, and the stolen cookies keep working even after the malware has been found and removed.
In practice this means three things:
- Two-factor authentication does not protect a session that has already been stolen. It protects the login, not what happens after it. You should still use it (see below), because it stops anyone who only has your password.
- A new password does not always end existing sessions. Google signs you out everywhere when you change your Google password, with some listed exceptions. Microsoft says its "Sign out everywhere" option can take up to 24 hours, and in Microsoft 365, resetting a password does not revoke app passwords. Other services behave differently again. Ending sessions is a separate step.
- Order matters. If the malware is still on the computer when you change your passwords, it can collect the new ones too. Clean the computer first, then change passwords from a different, clean device, then sign out all other sessions.
Prevention: what to do before anything happens
On every computer used for work
- Install software only from official websites and app stores. No cracked programs, no "free" versions of paid software, and no downloads from adverts. Type the vendor's address yourself or use a bookmark.
- Use a standard Windows account for daily work. Keep the administrator account for installing software and changing settings. The UK National Cyber Security Centre (NCSC) recommends this for small organisations, and Google notes that Chrome's newer cookie protection works best when users cannot run downloads as an administrator.
- Keep Windows, the browser and other programs updating automatically, and restart when the browser asks you to.
- Do not share a work computer for gaming, personal downloads or children's use. Browser profiles are not a security wall: Google says anyone using the device can switch between Chrome profiles, and malware running in your Windows account can reach all of them. If a computer must be shared, give each person their own Windows account.
- Never paste a command into Run, Terminal or PowerShell because a website, email or chat message told you to.
- Keep browser extensions to the few you need, and remove the rest.
Passwords
- Use a different password for every account, so that one stolen password does not open the others.
- Think about where passwords are stored. The NCSC says saving passwords in your browser is fine on your own devices and should never be done on shared ones, and that browser-saved passwords are only as secure as the device. On Windows, Google has said its older protection did not stop malicious programs running as the logged-in user from reading browser secrets, which is exactly what infostealers do. Chrome added stronger protection in version 127, and researchers reported stealers getting around it within months. For business accounts, Noiz suggests a dedicated password manager, locked with its own strong main password and two-factor authentication, so the browser's saved-password store is not holding the keys to your business.
- Check your saved passwords. Google Password Checkup (passwords.google.com) flags passwords that are exposed, weak or reused.
Two-factor authentication
- Turn it on everywhere it is offered, starting with email, because whoever controls your email can reset everything else. CISA, the US cybersecurity agency, says any form of multi-factor authentication is better than none.
- Prefer passkeys or a security key, then an authenticator app, and use SMS codes only as a last resort. CISA calls phishing-resistant methods (passkeys and hardware security keys) the gold standard, and the NCSC says passkeys should generally be used where a service supports them. Google and Microsoft accounts both support passkeys.
For your mailboxes and website
- Use a separate password for each mailbox, and do not reuse the mailbox password for the control panel, website admin or client area.
- Do not reuse the same personal email address as the login for every business system. If that one inbox is taken over, password reset links for everything else go straight to the attacker.
- Give staff their own logins instead of sharing one, so a single infected computer does not expose everyone.
- Think about where a stolen mailbox password can be used. A mailbox on a shared, public mail service can be opened from anywhere in the world the moment the password is sold. A mail server of your own, placed behind a firewall and reachable only from your office network or over a VPN, is a different proposition: a buyer on the other side of the world holds a password they cannot use unless they first get on to your network. It does not excuse the infected computer, which is already inside, but it takes the most common outcome, a stranger reading your mail from abroad, off the table. Noiz builds and runs such servers as Private Email: single tenant, fully managed, with a VPN and managed firewall as an option.
A quieter path: GNU/Linux and Free software
Every infostealer named in this article is a Windows program, and the routes it travels are Windows habits: a cracked installer from a file-sharing site, a lookalike download page behind an advert, a command pasted into PowerShell. A business that moves its everyday computers to GNU/Linux steps off that road. Software comes from the distribution's own signed repository through a package manager, so there is no hunting for download sites, and the thousands of programs built to raid a Windows machine do not run.
That is a smaller target, not immunity. A browser on Linux stores passwords and cookies much as it does on Windows, and a program you run yourself can read them, so the advice above about official software, standard accounts, unique passwords, a password manager and two-factor authentication applies without change. What Free software adds is that anyone can read the code behind the operating system, the browser and the mail program, and the people who do are not working for the vendor alone.
Servers are where the case is already settled: the web, mail and hosting platforms that run most businesses run on GNU/Linux. Noiz runs and secures GNU/Linux servers for clients under its Linux Server Administration service: monitoring and alerting, security hardening, regular updates and patching, and backup checks, on Debian, Ubuntu, AlmaLinux, Rocky Linux and other distributions, with or without a control panel. If you run a server of your own and would rather not be the one patching it, ask Noiz support about it.
Check whether you have already been exposed
- Have I Been Pwned (haveibeenpwned.com) shows which data breaches your email address appears in. Since January 2025 it also shows the websites your address was captured against in infostealer logs, once you verify the address through its free notification service.
- Hudson Rock, a security company, offers a free lookup of email addresses and domains against its infostealer data. Its search puts the email address in the web address, so you are sharing it with that company.
- Google Password Checkup checks the passwords saved in your Google account against known leaks.
A clean result does not prove you are safe. These services only know about the data they have seen.
If an infostealer has run on one of your computers
Signs include a warning from a breach notification service, unexpected "new sign-in" alerts, or a security researcher telling you that your address appears in stolen-credential data. Treat any such message with care: do not click its links or reply with information. Open the services concerned by typing their addresses yourself.
Work through these steps in order.
1. Stop using the infected computer
Do not log in to anything on it, and do not type new passwords on it. Disconnect it from the network if you can.
2. Clean it properly
An antivirus scan can remove the malware, but it cannot tell you what was copied before it was found, and stolen sessions keep working afterwards. For that reason Noiz recommends a full reset of Windows rather than relying on a scan. The NCSC's own advice is to wipe and reinstall a device from the operating system up if antivirus cannot clean it.
On Windows 11:
- Copy only the documents, photos and spreadsheets you need to an external drive. Do not copy programs, downloads or the browser profile.
- Go to Settings > System > Recovery and choose Reset PC.
- Choose Remove everything, then Cloud download, which installs a fresh copy of Windows from Microsoft.
- After the reset, make sure Windows Security (Microsoft Defender) is on and Windows Update has finished.
- Scan the external drive before copying files back. Windows Security also offers a Microsoft Defender Offline scan (Virus & threat protection > Scan options), which restarts the computer to scan it.
- Sign in to the browser only after step 4 below, so that sync does not bring old saved passwords back.
If you are not comfortable doing this yourself, have an IT technician do it.
3. Change passwords from a clean device
Use a phone or another computer that you trust. Start with your main email account, then:
- every account whose password was saved in the infected browser
- any other account where you used the same password
- your hosting control panel, website admin and client area
Give each account its own new password.
4. Sign out every other session
Changing a password is not always enough, so end the sessions explicitly:
- Google: myaccount.google.com > Security > Your devices > Manage all devices, then sign out of any device you do not recognise. Changing your Google password also signs you out on most devices.
- Microsoft account (personal): Advanced security options > Sign out everywhere. It can take up to 24 hours.
- Microsoft 365 (business): your administrator should revoke the user's sessions, remove any app passwords and check mailbox rules. Resetting the password alone does not revoke app passwords.
- Facebook: Accounts Centre > Password and security > Where you're logged in, then log out of all devices.
- Zoho: accounts.zoho.com > Sessions > Active Sessions, then terminate the sessions you do not recognise.
- WordPress (self-hosted): Users > Profile > Log Out Everywhere Else.
- Mailboxes hosted with a provider: changing the mailbox password ends access with the old one. Phones and mail programs will then ask for the new password.
5. Turn on two-factor authentication
Use a passkey or an authenticator app where you can, as described above.
6. Check for anything the attacker left behind
- Email: look for forwarding rules, filters that move or delete mail, automatic replies and changed recovery email addresses or phone numbers. In webmail these are usually under Settings, in sections such as Filters, Forwarding and Responses. Look through Sent Items for messages you did not send.
- Website: check the list of administrator users for accounts you do not recognise.
- Money: watch bank and card statements, especially if card details were saved in the browser, and tell your bank if anything looks wrong.
7. Consider your obligations under POPIA
Section 19 of the Protection of Personal Information Act requires a responsible party to take appropriate, reasonable technical and organisational measures to protect personal information. Section 22 says that where there are reasonable grounds to believe personal information has been accessed by an unauthorised person, the responsible party must notify the Information Regulator and the affected people as soon as reasonably possible. A business mailbox or admin account holding client details may fall within this. Since 1 April 2025, the Information Regulator requires security compromises to be reported through its eServices portal. Noiz is not a law firm; take advice on whether a particular incident must be reported.
Notices, researchers and "bug bounty" requests
Genuine security researchers sometimes write to tell people their details appear in stolen data, and those notices are worth acting on. Others send alarming messages and ask for payment. Some practical rules:
- Check any claim through the service's official website, not the links or contact details in the message. The NCSC gives the same advice for breach notifications.
- Never send passwords, identity documents or logs in reply to anyone.
- Do not pay unsolicited "bug bounty" requests. Sophos advises not engaging with the sender and having someone you trust check the reported issue instead.
- An email that quotes one of your old passwords and demands money usually relies on an old data breach, not on access to your computer. The NCSC advises not to engage or pay, and to change that password anywhere it is still in use.
Summary
- Infostealers copy saved passwords and signed-in sessions, and the data is sold on.
- They mostly arrive through pirated software, fake download adverts, phishing and fake "verify you are human" pages.
- Two-factor authentication stops password-only attacks but not stolen sessions, so prevention matters.
- Use official software only, a standard Windows account, automatic updates, unique passwords and a password manager for business accounts.
- Moving everyday computers to GNU/Linux removes you from the Windows-only stealers' reach; the same habits still apply there.
- If a computer is infected: stop using it, reset it, change passwords from a clean device, sign out everywhere, turn on two-factor authentication and check for forwarding rules and unknown admin accounts.
If you host with Noiz and think a mailbox, website or control panel login may be affected, contact Noiz support, and change the passwords from a clean device first.
Note: while some of this content was produced with the help of AI, the final editing has been done by a real human being.
