Infostealer malware: how it works, how to detect infostealer delivery, and how to respond to a compromise

Infostealers harvest credentials, session tokens, and stored secrets to fuel account takeover at scale. Learn how to detect infostealer delivery and its downstream impact.

Book a demo

Infostealers harvest credentials and sessions to fuel account takeover at scale

Infostealer malware extracts stored secrets from a compromised machine, such as saved passwords, session cookies, autofill data, cryptocurrency wallets, and application credentials.

Browsers are the primary target because they store the most valuable data, but infostealers also read from OS credential stores, application config files, SSH keys, and other local data stores. The stolen data feeds a criminal supply chain: credentials are sold on dark web marketplaces for credential stuffing campaigns, session tokens enable session hijacking, and stored secrets provide direct access to corporate environments.

Infostealers are distinct from the downstream attacks they enable. Session hijacking is the replaying of a stolen token — the infostealer is how the token was obtained. Credential stuffing uses stolen passwords — infostealers are a primary source. Understanding the malware itself — how it's delivered, what it steals, and how the stolen data circulates — is essential for breaking the chain.

How infostealers work

Infostealers target data at rest on the filesystem. Browsers store credentials, session cookies, and autofill data in local database files and encrypted stores — infostealers read these files directly, decrypt them where necessary, and exfiltrate the contents. Beyond browsers, infostealers also harvest from OS credential stores, application config files, cryptocurrency wallets, SSH keys, and other local secrets.

The user is tricked into executing the infostealer — typically through ClickFix, a malicious file download, or a trojanized installer
The malware reads browser data files on the filesystem — credential databases, cookie stores, autofill data — and extracts stored secrets from other local applications
Stolen data is exfiltrated to attacker-controlled infrastructure within seconds
The attacker — or a buyer on a criminal marketplace — replays stolen session tokens for immediate session hijacking, or uses stolen credentials for credential stuffing across SaaS applications
A single infection can compromise access to dozens of applications simultaneously

ClickFix is now the primary delivery vector for infostealers, having overtaken traditional file-based delivery. ClickFix tricks users into executing malicious clipboard commands rather than downloading a file — which means the infostealer is delivered without a file download that endpoint tools could scan. The infostealer ecosystem operates as a commodity market, with subscription-based services, operator dashboards, and continuous development, mirroring legitimate SaaS.

Why EDR alone doesn't solve the infostealer problem

For most organizations, EDR is the only line of defense against infostealers. EDR detects and blocks infostealer execution on managed endpoints, and it does that job well — but it is a single layer, and single layers have gaps.

EDR isn't installed on unmanaged devices. A significant proportion of infostealer infections that compromise corporate credentials happen on personal machines, contractor laptops, and BYOD — devices where EDR is absent entirely. And in cases where your employees are logged into their personal browser account (e.g. Google) on your managed corporate device, a personal device compromise can lead to the theft of corporate credentials where cross-device browser syncing has occurred.

Infostealers are under constant development precisely because evading EDR is the primary engineering challenge for their operators, and new evasion techniques regularly emerge. And when EDR misses an infection — or the infection happens on a device without EDR — organizations are left relying on dark web monitoring and threat intelligence feeds to find out their credentials were stolen. These feeds are useful but noisy: they're full of false positives from stale data, repackaged dumps, and credentials that have already been rotated. Distinguishing a genuine, actionable compromise from background noise in infostealer feeds is a significant operational burden, and many organizations lack the capacity to triage them effectively.

The limitations of compromised credential feeds

When EDR misses an infection — or the infection happens on a device without EDR — organizations typically find out through dark web monitoring and compromised credential feeds. These are the fallback, and they have structural problems.

Feeds are noisy. They're full of stale data, repackaged dumps, and credentials that have already been rotated. Distinguishing a genuine, actionable compromise from background noise is a significant operational burden, and many organizations lack the capacity to triage effectively. Feeds are also late — stolen credentials can circulate in marketplaces for months before appearing in a feed, and by then the attacker may have already used them. And feeds provide no visibility into stolen session tokens, which bypass authentication entirely and are the more immediate threat from infostealer infections.

The result is that organizations often discover an infostealer compromise only after a breach has occured.

Push Security browser controls blocking a high-risk file download before execution, showing how in-browser enforcement stops initial access attempts.

How Push tackles both infostealer delivery and the downstream consequences

Push addresses both sides of the infostealer problem: delivery prevention and downstream detection.

On the delivery side, Push detects ClickFix attacks — the primary infostealer delivery mechanism — through malicious copy-and-paste detection. When a page silently writes malicious commands to the user's clipboard and instructs them to execute it, Push detects the behavior and blocks the attack. Push's file download controls block risky file types from untrusted sources, reducing the volume of file-based infostealer delivery that reaches the endpoint. Because these controls operate in the browser, they can be easily deployed to unmanaged devices where EDR isn't installed via MDM.

On the downstream side, Push provides three detection layers for the consequences of infostealer infections. Compromised credential detection identifies when users log in with credentials that appear in known breach datasets and infostealer logs — using locally generated salted SHA256 partial hashes with no plaintext transmission, and behavioral corroboration to eliminate false positives from stale data. Session marker injection provides deterministic stolen-session detection — a session created in a Push-protected browser that appears in an uninstrumented browser is confirmed stolen. And browser sync detection identifies when corporate credentials are syncing to personal browser profiles, closing the exfiltration path the Okta breach exploited.

Frequently asked questions

Infostealers are malware designed to extract stored secrets from a compromised machine — primarily saved passwords, session cookies, and autofill data from browsers, but also credentials from OS stores, application configs, cryptocurrency wallets, and SSH keys. The malware reads these data files directly from the filesystem, decrypting them where necessary, and exfiltrates the contents within seconds. Infostealers are sold as commodity subscription services and are the primary supply chain for credential stuffing and session hijacking attacks.

ClickFix is now the primary delivery vector — tricking users into executing malicious clipboard commands rather than downloading a file. Traditional delivery vectors remain active: malicious file downloads (fake updates, trojanized installers, drive-by downloads), malvertising and SEO poisoning, and software supply chain compromise through npm and PyPI packages. ClickFix delivery is particularly effective because it bypasses file-based scanning entirely.

Primarily browser data: saved passwords, session cookies (enabling session hijacking), autofill data (addresses, payment information), and extension data. But they also harvest from beyond the browser — OS credential stores, cryptocurrency wallets, SSH keys, application config files, and other local secrets. A single infection can compromise access to dozens of applications simultaneously. Stolen data is exfiltrated within seconds and typically sold on criminal marketplaces or used directly for account takeover.

Infostealers read session cookie files from the browser's data directory on disk. These cookies represent authenticated sessions — an attacker who replays a stolen session cookie can access the account without needing the password or MFA. The stolen session is valid from the application's perspective, and refresh tokens can persist for weeks or months. Push detects this through session marker injection — a session created in a Push-protected browser that appears elsewhere is confirmed stolen.

Infostealers read saved passwords from browser credential databases on disk, which are then sold on criminal marketplaces or used directly in automated credential stuffing attacks against SaaS applications. Stolen credentials can sit in marketplaces for months or years before being weaponized — organizations often discover they were compromised by an infostealer long after the initial infection, when the stolen credentials surface in an attack. Push detects compromised credentials at the point of login, identifying when users authenticate with passwords found in breach datasets and infostealer logs.

EDR detects and blocks infostealer execution on managed devices, but a significant proportion of infostealer infections that compromise corporate credentials happen on unmanaged devices — personal machines, contractor laptops, BYOD — where EDR isn't installed. ClickFix-delivered infostealers also bypass file-based scanning because the user executes a clipboard command rather than opening a file. The fact that this action is user-initiated can also reduce the priority of security alerts generated. And EDR can't detect the downstream effects — stolen session replay and credential reuse happen in the browser, not at the endpoint. Push complements EDR by detecting ClickFix delivery and blocking risky downloads on any device with the browser extension (including unmanaged devices), and by catching stolen credential and session usage regardless of where the infection occurred.

Defense requires coverage at both the delivery and consequence layers. EDR covers infostealer execution on managed endpoints. Browser-level detection (Push) covers ClickFix delivery, malicious file downloads, and works on unmanaged devices where EDR is absent. On the consequence side, compromised credential detection catches stolen passwords at login, session marker injection detects stolen session replay, and dark web monitoring surfaces credentials in infostealer dumps. No single tool covers both layers — Push and EDR together provide the most complete coverage.