Infostealer Malware: 10 Questions Small Business Owners Ask

Infostealer malware copies saved passwords and logged-in sessions off a computer and sells them. Here are ten questions owners ask about it, answered short.

What is infostealer malware?

It's malware built to grab credentials, not to lock files. In seconds it copies saved browser passwords, session cookies, autofill data and crypto wallets, then sends them to the attacker.

Many run once and delete themselves. The theft is done before anyone notices.

How big is the problem in 2026?

Big and growing. Flashpoint's midyear 2026 threat report counted 1.7 billion credentials stolen by infostealers between January and June 2026, from 7.4 million infected devices, a 27% jump on the prior six months.

Vidar, StealC and Lumma were the top three families.

Why should a small business care?

Because work logins are in those dumps. Flare's 2026 infostealer exposure research found Microsoft Entra ID in 79% of logs that exposed enterprise identity credentials.

If you run on Microsoft 365, that's your login. One stolen sign-in can open email, SharePoint and every app tied to it.

How do infostealers get onto a computer?

Usually the user installs them without knowing. Common routes are cracked software, fake browser updates, malicious search ads and fake CAPTCHA pages that tell people to paste a command.

We've covered two of the biggest in ClickFix fake CAPTCHA attacks and malvertising and SEO poisoning.

Does MFA stop an infostealer?

Not always. If the malware takes a live session cookie, the attacker can reuse a session that already passed MFA. Flare found 1.17 million logs holding both enterprise credentials and session cookies, which it says enables "immediate access and potential MFA bypass."

Keep MFA. Add controls that check the device too, covered in our guide to session hijacking and MFA bypass.

Will antivirus catch it?

Sometimes, not reliably. Infostealers change constantly and often run once and exit, while basic antivirus works off known samples.

An EDR tool that watches behavior, such as a process reading browser credential stores, has a much better shot. Even then, a caught infection may already have sent the data out.

What about employees' personal computers?

That's where a lot of this starts. Someone signs into Microsoft 365 from a shared home PC, and the browser keeps the session.

Block unmanaged devices from company data with Conditional Access, or limit them to browser-only access with no downloads. Our BYOD policy FAQ covers the options.

How do I know if our credentials were stolen?

You often find out from someone else: a bank, a vendor or a monitoring service. Dark web monitoring watches stealer-log markets for your domain.

Inside Microsoft 365, look for sign-ins from unfamiliar locations, new inbox rules and unexpected MFA registrations. Those are the same signs we list for a compromised Microsoft 365 account.

What do we do if a computer is infected?

Assume every saved password and session on it is gone. Pull the machine off the network, then reset the user's password from a clean device.

Next, revoke the user's sessions in Microsoft Entra ID. Microsoft notes access tokens last one hour by default, so watch that window.

Change every other password that was saved on the machine, starting with banking and email. Then wipe and rebuild the computer. Cleaning it isn't enough.

How do we prevent it?

Stop saving passwords in the browser, and stop users installing software. Put passwords in a business password manager, remove local admin rights, and run EDR on every endpoint.

Then require compliant devices for Microsoft 365. Phishing-resistant sign-in with passkeys cuts the value of a stolen password further.