Strong passwords cannot protect you if your device itself is watching. This guide explains the malware that steals passwords, and how to deal with it. It is part of our section on data breaches and hacked accounts.
The two main types
| Type | What it does |
|---|---|
| Keylogger | Records what you type, including passwords |
| Infostealer | Copies saved browser passwords, cookies, autofill data, crypto wallets and files in seconds |
Infostealers are now the bigger problem. They grab everything in one go, send it to the attacker and may delete themselves. Stolen logs are then sold in bulk.
How it gets onto your device
- Cracked software, game cheats and pirated downloads.
- Fake installers from search ads.
- Email attachments, such as fake invoices.
- Malicious browser extensions.
- Fake "AI tools", video downloaders and updates.
Warning signs
Many infections show no signs at all. You may notice:
- Logins from places you have never been.
- Accounts stolen one after another, even though you use unique passwords.
- New browser extensions or programs that you did not install.
- A device that suddenly runs slowly or hot.
- Security software turned off.
What to do if you suspect infection
- Disconnect the device from the internet.
- On a different, clean device, change the passwords for your email, password manager and bank.
- Log out of all sessions, to cancel any stolen cookies.
- Run a full scan with reputable security software.
- If in doubt, back up your personal files and reinstall the operating system.
- Change your remaining passwords and check your recovery settings.
If you hold crypto in a software wallet on that device, treat its recovery phrase as stolen, and move your funds at once.
How to avoid it
- Download only from official sources.
- Keep your system, browser and apps updated.
- Avoid saving passwords in a browser on a shared or unprotected computer. See browser vs password manager.
- Do not disable your security software for an installer.
- Use a security key or passkey where possible.
- Use a standard user account rather than an administrator account for daily work.
Crypto holders should also read about clipboard hijackers and screen recorders.