Last updated: October 30, 2026
An infostealer is malware that quietly copies everything valuable from your computer in seconds: saved passwords, browser cookies that keep you logged in, crypto wallet files and extension data, seed phrases stored in notes or screenshots, and Telegram sessions. It usually arrives with cracked software, fake game cheats or fake "AI tools". Stolen cookies let attackers into exchange and email accounts without your password or 2FA, and stolen wallet files let them crack and empty your wallet. A compromised work laptop was also the starting point of the $6.3 billion Binance hack. Below: how infostealers get in, what they take and what to do if you're infected.
- Seconds to copy a whole browser profile
- 2FA bypassed with stolen session cookies
- 1 cracked installer is enough
- New seed — the only fix for an exposed wallet
What an infostealer takes
| Target | What the attacker can do with it |
|---|---|
| Browser cookies and sessions | Open your exchange, email or Telegram as if they were you — no password or 2FA needed |
| Saved passwords and autofill | Log in anywhere you reused them |
| Wallet extension data (e.g. MetaMask) | Crack the wallet password offline, then take the seed and the funds |
| Desktop wallet files | Same: brute-force the password at leisure |
| Text files, notes, screenshots | Any seed phrase or private key you saved there is gone instantly |
| Telegram and Discord sessions | Scam your contacts from your account |
Most infostealers run once, upload everything to the attacker and delete themselves, so you may notice nothing until money disappears weeks later. Stolen logs are sold in bulk, and buyers search them for exchange sessions and wallets.
How infostealers get in
- Cracked software and "free" paid apps, often promoted in YouTube videos and file-sharing sites.
- Fake game cheats, mods and trading bots, popular bait in crypto and gaming communities.
- Fake downloads from search ads that imitate wallets, AI tools or video software — verify every download.
- "Fix it yourself" prompts: fake CAPTCHA or error pages that ask you to paste a command into Run or Terminal.
- Job offers and "test tasks" that ask you to run a project or join a call with special software — a favourite trick of state-backed crypto hackers.
- Malicious browser extensions — fake crypto extensions.
Think you're infected? Do this, in order
- From a different, clean device, create a brand-new wallet with a new seed and move your funds there. Don't reuse the old seed, even with a new password — seed phrase compromised: what to do.
- Log out of all sessions on exchanges, email and Telegram ("terminate all other sessions"), then change those passwords from the clean device.
- Reset 2FA and prefer an authenticator app or security key over SMS — crypto 2FA guide.
- Check exchange withdrawal whitelists and API keys for anything you didn't add.
- Wipe and reinstall the infected computer. Antivirus cleanup isn't enough to trust it with crypto again.
- Watch for follow-up scams using your stolen data — phishing emails and SMS.
How to protect yourself
- Never store a seed phrase digitally — no notes, screenshots, cloud or password manager. Paper or steel only — seed backup guide.
- Keep savings on a hardware wallet. Malware can't copy a key that never touches the computer — hot vs cold wallets.
- Use a separate device or user profile for crypto, with nothing pirated and as few extensions as possible.
- Don't run what strangers send you: "test tasks", bots, cheats or "fixes".
- Keep less on exchanges, so a hijacked session can't take much — and use withdrawal address whitelists.
Frequently asked questions
What is an infostealer?
Malware that collects passwords, browser cookies, wallet files, seed phrases and messenger sessions from an infected computer and sends them to the attacker, usually within seconds of running.
Can an infostealer bypass 2FA?
Yes, by stealing session cookies. The attacker imports your logged-in session into their browser, so the site never asks for a password or 2FA code. Logging out of all sessions kills those cookies.
Can an infostealer steal my MetaMask wallet?
It can copy the encrypted wallet data from your browser and try to crack your password offline. A weak password falls quickly. If you were infected, move funds to a new wallet with a new seed.
Is my hardware wallet safe from infostealers?
The private key is, because it never leaves the device. Malware can still try to trick you into signing a bad transaction, so always check the address and amount on the device screen.
How do I know if I have an infostealer?
Often you don't — most delete themselves after uploading. Warning signs are logins from unknown places, sessions you didn't start and messages sent from your accounts. If you ran anything suspicious, act as if you're infected.
An instant swap needs no account, so there's no session for an infostealer to steal: compare live offers on /swap, for example BTC → XMR. No account, no ID, no logs.