An infostealer is a type of malware built to harvest sensitive data from an infected computer and send it to the attacker. It usually targets what web browsers and apps store for convenience: saved logins, session cookies, autofill entries, crypto wallets and details about the device.

How it works

• The malware arrives through phishing, fake software downloads, cracked programs or malicious ads.
• It reads browser credential stores and other password storage locations, as described in MITRE ATT&CK T1555.003.
• It copies session cookies, which can let an attacker log in without the password or the second factor.
• It packs the data into an archive, often called a log, and uploads it to the attacker’s server.

Why it matters for dark web monitoring

Infostealer output is sold and shared in bulk as stealer logs. One infected personal laptop can expose company VPN, email and cloud accounts, because people often save work logins in their browser. Stolen cookies enable session hijacking even when MFA is in place. Services that watch for stolen credentials and stealer logs help security teams reset passwords and revoke sessions before the access is used.

Sources: MITRE ATT&CK T1555.003: Credentials from Web Browsers, MITRE ATT&CK T1539: Steal Web Session Cookie