Infostealer
An infostealer is malware designed to collect and steal information from a device, which may include saved credentials, browser cookies, documents, and application data.
The device can expose more than passwords
A browser may hold saved passwords and cookies associated with signed-in sessions. Other applications may hold additional secrets or sensitive files. What an infostealer can collect depends on its capabilities, permissions, and the protections around that data.
Microsoft’s May 2025 analysis of Lumma Stealer describes theft of browser passwords, session cookies, wallet information, and documents. The same report describes delivery through phishing, malicious advertisements, and deceptive downloads. Those are findings about that malware and its campaigns, not a list of capabilities every infostealer shares.
Delivery, theft, and account access are separate events
A suspicious download does not prove the program ran or that information left the device. Search ads to execution explains how to connect browser and endpoint evidence before making those claims.
If credentials or cookies were taken, removing the malware does not retrieve the stolen copies. Endpoint response and identity response need to work together. The token and session-cookie guide explains why a password and an existing session represent different access paths; the containment review follows the actions needed to verify that access has ended.
Not every stolen session comes from an infostealer. Phishing proxies and other forms of session theft can expose access without this kind of malware infection. Establish the collection mechanism from evidence rather than inferring it solely from suspicious account activity.