Infostealers: How They Work and How to Protect Business Access

An infostealer is malware designed to quietly collect information useful to an attacker. It does not necessarily lock a computer; its goal is often to leave with access that can be reused immediately.

For a small or mid-sized business, the risk is practical. One compromised endpoint can expose email, invoicing, social media, business tools, and administrator accounts. This guide explains the scenario and the first controls to put in place. It is not a substitute for specialist incident response.

1. What an infostealer looks for

The malware inspects places where a user or application stores information to make sign-in easier:

• passwords saved in a browser or application;
• cookies and session data representing an already authenticated connection;
• tokens, keys, wallets, and configuration files;
• history, forms, extensions, and device information;
• data that helps map services and prepare a second attack.

MITRE ATT&CK documents access to credentials stored in browsers. The data does not have to be visible on screen to matter: a local database, browser profile, or open session may be enough.

2. How the attack unfolds

The scenario is usually a short chain:

1. a user installs pirated software, opens a malicious attachment, or follows a fake link;
2. the program runs on the endpoint and searches accessible data;
3. the information is collected and sent to the operator;
4. credentials are tested, sold, or used to prepare fraud;
5. the attacker moves to other services using reused credentials or active sessions.

An infostealer does not need to break the encryption of a remote vault to be dangerous. It can act when a secret is unlocked or a session is active. The endpoint, browser extension, and local copies are therefore part of the security boundary.

The risk is not limited to computers. On Android, some banking trojans abuse accessibility services to read on-screen elements, automate actions, or display fake screens. ThreatFabric also documented Perseus, distributed under the guise of IPTV apps: an English-language variant has a command that opens and browses certain note-taking apps. This capability belongs to the samples studied and should not be generalized to all mobile malware. For a business, a phone used for email, business tools, or authentication can expose work access. Read our analysis of Perseus and Android notes.

3. Why MFA is not the whole answer

Multi-factor authentication remains essential: a stolen password is less useful when a second factor is required. But MFA cannot repair a compromised device. An attacker who obtains a session cookie may be able to reuse an approved session without triggering the same authentication flow again.

Modern protections increasingly bind sessions to the original device. This improves resistance to cookie theft, while still requiring endpoint protection, sensible session lifetimes, and a way to revoke sessions.

4. Reduce endpoint exposure

Start with devices used for sensitive accounts:

• enable automatic updates for the operating system, browser, and extensions;
• block unapproved software installation and remove unnecessary extensions;
• use a standard daily account without administrator privileges;
• enable session locking and disk encryption;
• avoid saving critical credentials in multiple browsers or files;
• make it easy to isolate a device and report suspicious behaviour.

For Android phones used at work, keep the operating system up to date, leave Google Play Protect enabled, and install apps from a trusted source. Decline APK installations prompted by an unexpected ad or message. Review requests for Accessibility access carefully: these services are legitimate and useful, but an app asking for them without a clear reason deserves scrutiny. Settings and protections vary by Android version and device maker.

An encrypted local vault can reduce credential sprawl and centralised copies. It cannot protect a secret that is already unlocked on an infected device: endpoint, browser, and session security remain necessary.

5. Organise business credentials

Inventory the access that could stop operations: email, domains, hosting, accounting, backups, banking, customer tools, and administration consoles. For each one, record an owner, authorised users, privilege level, and revocation procedure.

Then apply a few simple rules:

• one different secret for each service;
• named accounts instead of shared credentials;
• MFA wherever the service supports it;
• rotation after offboarding, suspicion, or exposure;
• encrypted backups whose restoration is actually tested.

Soclyde can help generate unique secrets, keep them in an encrypted vault on the organisation’s devices, and share only what is needed. This limits reuse after theft, but it does not replace controls on the protected service.

6. Respond to a compromised endpoint

Do not only change the password from the suspicious device. The new entry could be observed as well. Prepare a procedure using a clean device or a fallback channel:

1. disconnect or isolate the endpoint without immediately destroying useful evidence;
2. alert the designated owner and record the time, user, and symptoms;
3. revoke active sessions and devices for accounts used on the endpoint;
4. replace priority secrets from a clean environment;
5. check mail forwarding rules, new users, keys, and administrator access;
6. preserve evidence and have the endpoint analysed before returning it to service;
7. notify affected people or partners if a shared access may have been exposed.

Speed matters, but an unstructured rotation can miss a secondary account. Use the inventory and start with identities that can reset or administer the others.

7. SMB checklist

Priority measures against credential theft

Priority	Action	Expected evidence
Today	Enable MFA on email and administrator accounts	Covered-account list and recovery method
This week	Patch endpoints and remove unnecessary extensions	Device status and approved-extension list
This month	Replace reused secrets and shared accounts	Access inventory, owners, and rotation date
Test	Isolate a device, revoke a session, and restore a backup	Record with timing, owner, and corrective actions

The right level of protection is the one the team can maintain. Include business phones in the device inventory and incident procedure. If compromise is suspected, alert the IT owner, follow the organisation’s procedure, and use a clean device to revoke sessions and replace exposed secrets. Start with accounts that unlock access to others, document exceptions, and repeat the tests after major changes.

In summary

Infostealers exploit trust in devices and persistent connections. Reducing the risk takes a combination of patched endpoints, named accounts, unique secrets, MFA, a locally controlled vault, and a workable incident procedure. No single measure is enough, but every removed copy and every revocable access shortens an attacker’s path.