Protecting yourself from infostealers requires two separate plans: keep malware off the device, and assume that both saved passwords and active sign-in sessions could be exposed if the device is compromised. Use unique credentials, phishing-resistant multi-factor authentication, carefully managed passkeys, current browser and operating-system protections, and a clean-device recovery process that revokes sessions—not just passwords.
What infostealer malware can take
Infostealers are malicious programs designed to search a device for valuable information. In a browser profile, that can include saved usernames and passwords, autofill data, cookies, extension data, browsing-related tokens and cryptocurrency-wallet information. The exact data depends on the malware, browser, operating system and permissions it obtains.
As an Amazon Associate I earn from qualifying purchases.
There are two distinct account risks:
- Credential theft: a criminal obtains a password and can try it on the original service or other sites where it was reused.
- Session theft: a criminal obtains an authentication cookie or similar token that represents an already authenticated browser session. They may be able to use it without knowing the password or completing multi-factor authentication again.
The Cyber Safety Review Board documented the theft and monetization of authentication cookies through infostealer malware. Microsoft’s guidance for confirmed session-cookie theft likewise treats token revocation as a separate response. Therefore, changing a password alone does not prove that an attacker’s existing session has ended.
Free tools Windows power users keep installed
One-click scans. No signup required.
Build protection before an infection
Use a different, long password for every account
Make every password unique, especially for email, financial services, cloud storage, social accounts and any account that can reset other accounts. A long randomly generated password is preferable to a short phrase that has been reused. If one site is breached or one browser credential is stolen, uniqueness prevents the same secret from unlocking your other accounts.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
The Federal Trade Commission notes that “A web browser, mobile browser, and password manager all can save your passwords for you.” A password manager can generate and fill unique passwords, reducing reuse and the temptation to keep a list in an unprotected document. Choose storage and recovery arrangements you understand, and keep the manager itself protected by a strong primary credential and multi-factor authentication where available.
Turn on multi-factor authentication, preferring stronger methods
Enable MFA on email first, then on financial, work, cloud and social accounts. When a service offers choices, prefer an authenticator app or a FIDO2 security key over text-message or email codes. FTC consumer guidance and CISA’s organizational guidance both recommend MFA and identify authenticator-based or security-key methods as more secure options than relying only on passwords and weaker one-time-code channels.
MFA does not make an infected device safe. An infostealer can still copy a password, steal a live session after you sign in, or capture other data stored on the device. MFA is a layer that makes password-only reuse and many phishing attempts harder; it is not a substitute for malware cleanup and session revocation.
Recommended Free Tools
Consider a FIDO2 security key for important accounts
A FIDO2 security key can provide phishing-resistant authentication for compatible services and devices. Register a primary key and, if the service permits it, a spare key kept in a secure place. Before depending on a key, confirm that the account supports it and document a recovery method. Losing the only key without a recovery option can lock you out.
Password managers and browser storage: what protection they do and do not provide
Browser password managers are convenient and can reduce dangerous password reuse. Chrome documents protections such as matching autofill to the intended site, identity confirmation in some situations, and encryption whose details depend on the operating system, device settings and account configuration.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Those safeguards protect against certain mistakes and unauthorized viewing; they are not evidence that browser storage is safe when malware is running on the computer. Malware with access to your user account may read data after it has been decrypted for use, inspect browser profiles, or steal active cookies. An unlocked or compromised device remains a high-risk environment even when the browser uses encryption.
Check where credentials and passkeys are stored
Chrome can store passwords and passkeys in Google Password Manager, in a local browser profile or on a physical security key. Availability varies by operating system, browser version, account and organizational policy. Review the browser’s password and passkey settings and identify:
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →- Which credentials synchronize to your account and which remain only on one device.
- What unlock or identity confirmation is required before credentials can be used.
- How you recover access if the phone, computer or security key is lost.
- Whether another trusted device, backup key or account recovery method exists.
Do not rely on a single local device or hardware key unless you have deliberately accepted the lockout risk and prepared recovery.
Use passkeys with a realistic recovery plan
Passkeys use public-key cryptography and are tied to the site or application for which they were created, which can reduce phishing risk. Google describes them as “a simple and secure way to sign in to both your Google Account and the sites and apps you care about — without a password.”
Passkeys are not identical everywhere. Some synchronize through a password manager or platform account; others remain local to a device or security key. Synchronization, supported devices and recovery differ by provider. A local or hardware-key passkey may not be recoverable if that device or key is lost.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
| Credential approach | Phishing resistance | Works across devices | Recovery concern | Session revocation still needed after infection? |
|---|---|---|---|---|
| Unique password plus MFA | Depends on the MFA method; security keys and authenticator methods are stronger than SMS or email codes | Usually broad, if the account supports the method | Keep backup codes, a second factor or another approved recovery method | Yes |
| Synced passkey | Strong against fake-site phishing because it is site matched | Often, but synchronization depends on the provider and storage platform | Confirm how a replacement device restores the passkey | Yes, if sessions or tokens may have been exposed |
| Local or hardware-key passkey | Strong against fake-site phishing | Only where the device or key is available and supported | A lost or damaged sole key may be unrecoverable without another registered method | Yes |
Use the approach each service supports, but record recovery options before removing the last password or second factor.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Reduce the chance of an infostealer infection
Keep the operating system, browser and extensions current
Install security updates for the operating system and browser promptly. Remove extensions you no longer need, and review the publisher, permissions and installation source before adding one. An extension that can read or change data on websites has substantial access; treat unexpected prompts to install extensions as a warning sign.
Be cautious with downloads and “fixes”
Infostealers are often delivered through deceptive downloads, cracked software, fake updates, malicious advertisements, phishing pages or files sent through compromised accounts. Do not disable security controls to run an untrusted installer. Verify that a download comes from the developer or service you intended to use, and avoid pirated software and unknown browser add-ons.
Protect the device itself
- Use a strong device sign-in method and lock the screen when away.
- Use a standard user account for everyday work when practical; approve administrator prompts only when you understand why they appear.
- Enable full-disk encryption where your operating system provides it.
- Maintain backups that are disconnected or otherwise protected from routine modification.
- Do not store recovery codes, exported password databases or private keys in an unencrypted, shared folder.
CISA warns that malware may access, read, edit, steal or deny access to data stored on a device. Encryption and secure backups reduce the impact of device loss or data damage, but they do not replace changing exposed credentials and revoking exposed sessions.
Warning signs that deserve immediate action
Investigate promptly if you notice unfamiliar sign-ins, password-reset messages you did not request, changed recovery email addresses or phone numbers, new MFA devices, unexplained browser extensions, antivirus or security settings being disabled, unusual cryptocurrency activity, or accounts that appear active after you changed their passwords.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
A single symptom does not prove an infostealer. Treat a combination of account anomalies and suspicious software as enough to begin containment, especially for email, financial and work accounts.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What to do if you suspect an infection
1. Stop using the suspected device for account recovery
Use a device you believe is clean—such as a separately updated computer or phone—to change passwords and review account security. Do not sign in to every account from the potentially infected browser first; doing so can create fresh sessions for an attacker to steal.
2. Protect the account that controls recovery
Start with your primary email and identity provider because they can reset other accounts. Change its password to a new, unique value, verify the recovery email and phone, remove unfamiliar MFA methods, and review recent security activity. Then work through financial, work, cloud-storage and other high-impact accounts.
3. Change every exposed or reused password
Change passwords that were saved in the affected browser, entered on the suspected device, or reused elsewhere. If the same password was used on several services, change it on all of them—even if only one account shows suspicious activity.
4. End existing sessions and revoke tokens
Use each provider’s account-security controls to choose options such as “sign out of all devices,” “sign out other sessions,” “revoke sessions,” or “remove connected apps.” Some services distinguish browser sessions, refresh tokens, API keys and app passwords; revoke each exposed credential type that the provider lets you manage.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Microsoft’s session-cookie-theft response guidance recommends resetting credentials and disabling or revoking tokens for a confirmed incident. Consumer menus differ by provider, so look for active sessions, devices, connected applications and token-management pages rather than assuming a password change ended every session.
5. Remove untrusted browser extensions
In Chrome, open the extensions manager, remove anything you do not recognize or no longer trust, and review the permissions of the remaining extensions. If an extension returns after removal or settings keep changing, continue with the broader cleanup steps instead of reinstalling it.
6. Reset browser settings when appropriate
Google’s malware-cleanup guidance recommends resetting browser settings when unwanted changes persist. A reset can remove altered search engines, startup pages and other modifications, but it does not by itself prove that malware has been removed or that stolen sessions are invalid.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems7. Update and scan the operating system
Install pending operating-system updates and use the platform’s security tools to scan the computer. Follow the operating-system or browser maker’s cleanup instructions. Do not download random “cleaner” programs promoted by pop-ups; those can be another infection route.
8. Escalate if symptoms continue
If suspicious behavior remains after removing extensions, updating and scanning, Google advises that you may need to reset the computer or ask the manufacturer for help. A reset can erase local malware, but back up only files you trust and complete account recovery from a separate clean device first. For work equipment or accounts, contact your organization’s IT or security team rather than attempting an independent forensic investigation.
Account-by-account recovery checklist
| Priority | Actions from a clean device | Evidence to review |
|---|---|---|
| Email and identity provider | Change password; enable strong MFA; verify recovery methods; sign out other sessions; revoke unknown apps and tokens | Recent sign-ins, forwarding rules, recovery changes, new MFA devices |
| Financial and payment accounts | Change credentials; revoke sessions; contact the institution if transactions or details changed | Transfers, payees, cards, login locations and alerts |
| Work and school accounts | Notify IT or security; follow the organization’s reset and device-isolation process | Endpoint alerts, mailbox rules, file access and MFA changes |
| Cloud storage and social accounts | Change reused passwords; revoke sessions and connected apps; remove unfamiliar recovery options | Downloads, posts, messages, sharing links and active devices |
Common mistakes that leave attackers connected
- Changing only the password: a stolen cookie or refresh token may remain valid until explicitly revoked or it expires.
- Recovering accounts on the infected computer: newly entered passwords and fresh sessions can be captured again.
- Keeping a suspicious extension “for testing”: remove it before further sign-ins.
- Assuming MFA defeats malware: MFA helps with authentication but does not erase a stolen session.
- Resetting the browser but not the operating system: browser settings can be clean while a malicious program remains installed.
- Ignoring reused passwords: an exposed password can be tried against every service where it appeared.
- Deleting evidence before contacting work IT: an organization may need logs or the device for investigation.
When to involve your employer, bank or law enforcement
Contact your organization’s IT or security team immediately for a work account, managed computer or company data. They can isolate the device, revoke enterprise tokens, inspect sign-in logs and preserve evidence. Do not connect a suspected personal device to corporate systems while it is under investigation.
Contact banks, card issuers or payment services through official channels if funds moved, payment details changed or an attacker may have accessed financial information. Use the provider’s fraud process, not a phone number supplied in an unexpected message.
A sustainable maintenance routine
- Review browser extensions and account sessions monthly.
- Install browser and operating-system security updates as soon as practical.
- Replace reused passwords with unique manager-generated credentials.
- Enable MFA on newly created accounts before adding personal data.
- Test that your backup MFA method, spare security key or recovery codes actually work, without storing them on the same device.
- Keep at least one recent backup protected from ordinary ransomware or malware changes.
The goal is not to make compromise impossible. It is to limit what one infected device can expose, make account takeover harder, and ensure you can invalidate both credentials and sessions quickly.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
