Infostealers: the silent threat you feed without knowing it

There are cyberattacks you never see coming.
No flashy virus, no ransom messages, no brutal crash.
Just one thing: your credentials have been siphoned off. Your access has been copied. Your data, resold. And you never even noticed.

That's the specialty of infostealers.

This malware is discreet. It makes no noise. It doesn't encrypt your files. It blocks nothing.

It steals, in silence.

And today, it sits at the heart of most compromises suffered by companies, government bodies and individuals. Not because the infrastructure is vulnerable. But because people are.

What is an infostealer, and how does it work?

An infostealer is a thief operating in stealth mode.

It installs itself on your machine, often without your knowledge, through an attachment, a booby-trapped download, a fake piece of software or a dubious extension. Once in place, it harvests your passwords, session cookies, saved credentials and keys, sometimes even your keystroke captures or the contents of your clipboard. Then it sends all of it to the attacker's server... and disappears.

No alert. No ransom demand.

Just compromised accounts, access resold, identities stolen, and sometimes entire companies collapsing because "somebody" clicked in the wrong place.

Why are infostealers at the heart of so many compromises?

For a long time, we pictured the hacker as someone forcing a lock. Today, more often than not, they simply walk in with a key that has already been stolen. In its 2025 data breach report, Verizon analysed more than twelve thousand confirmed breaches: the abuse of valid credentials is the very first initial attack vector, present in 22% of cases. And those credentials are very often delivered ready to use by infostealers.

The Snowflake affair, in 2024, is the brutal demonstration of it. Attackers reused credentials siphoned off by several infostealers, among them RedLine, Vidar and Lumma, to log in to the platform's customer instances. Around 165 organisations were exposed, and Mandiant established that the accounts hit were protected by no two-factor authentication at all: a simple username and password was enough. More troubling still, some of those credentials had been stolen as far back as 2020. The theft is silent, but the bill can land years later.

The phenomenon has gone industrial. Between mid-March and mid-May 2025, Microsoft counted more than 394,000 Windows computers infected by the Lumma infostealer alone, whose infrastructure was dismantled in mid-May together with the US Department of Justice, Europol and the Japanese authorities. One single piece of software, rented out as a service to hundreds of criminal customers, and already hundreds of thousands of machines emptied of their secrets.

In France, the trend is the same on the consumer side. In its 2024 activity report, Cybermalveillance.gouv.fr notes that account hacking jumped 55% and is settling in as the second biggest threat to individuals, while requests for help linked to personal data breaches rose 82%. Behind those figures, almost always, credentials in circulation.

The real danger is the illusion of protection

For 20 years, the public has been sold the idea that cybersecurity is a matter for specialists. That an antivirus is all it takes. That there's no need to worry, the tools handle everything.

That's false.

It's precisely the most everyday, most harmless habits that have become the main weak points.

And among them, one mistake comes up again and again: saving your passwords in the browser.

Yes, it's simple. Yes, it's built in. But no, it isn't secure.

A browser is an access tool, not a vault. It's exposed, riddled with scripts, sometimes cluttered with extensions whose origin and behavior you don't know. And infostealers know this all too well. It's their number one target, in fact.

This isn't a technical question, it's a question of responsibility

When a cyberattack hits a hospital or a government body, it's too late for promises. Action was needed before. Planning. Support. Anticipation.

What I'm asking of you isn't an extra budget. It's a clear, stable, public course. It's leadership that lasts longer than a five-year term. It's an acknowledgment that digital is not a tool: it's vital infrastructure.

And like any infrastructure, it has to be maintained, protected, monitored. Not only at the moment when everything breaks.

For years, I've been warning about this dangerous drift: believing that cybersecurity is someone else's business. The IT departments'. The CISOs'. The "geeks'."
But the reality is that each of us is a way in.
And the first step toward a safer digital world is accepting that we all bear a share of responsibility.
That's exactly why I wrote Être en cybersécurité.
Not to produce one more technical guide.
But to show that digital security is a question of culture, not jargon.
And that if we keep ignoring the weak signals, we'll all end up paying dearly for them.

How do you actually protect yourself from infostealers?

Panic won't save us.

Method will. And rigor. Here are the basics:

• Never save your passwords in a browser. It's convenient. And that's just it: it's too convenient to be trustworthy.
• Use a secure password manager. Yes, it's a constraint. But it's also your last line of defense.
• Keep your work and personal use separate. If your family computer is infected, your professional access falls too.
• Update your tools. Always. A tool left un-updated is an open door.
• Turn on two-factor authentication everywhere you can. It's often the only thing that saves you when everything else is compromised.
• And above all: don't browse blind. A dubious site, a strange link, an unexpected attachment? Close it. Delete it. Check it.

We no longer have the luxury of being careless

The recent breaches (France Travail, CAF, bank accounts, consumer platforms) aren't anomalies. They're the symptom of a system where everyone is counting on everyone else to secure the rest.
But security cannot be delegated. It has to be owned.
Today, hackers no longer try to force the door.
They count on the fact that we leave it ajar.
Out of ignorance. Out of fatigue. Out of laziness, sometimes, too.
And as long as we accept that, the infostealers will keep winning.

---

Sources

• Leading initial attack vector: abuse of valid credentials, present in 22% of the intrusions analysed, 2025 report: Verizon, 2025 Data Breach Investigations Report.
• Takedown of the Lumma infostealer and more than 394,000 Windows PCs infected in the spring of 2025: Microsoft, On the Issues.
• Around 165 Snowflake customers compromised through credentials stolen by infostealers, on accounts with no two-factor authentication, 2024: Mandiant, Google Cloud.
• Account hacking up 55% and personal data breaches up 82% in France: Cybermalveillance.gouv.fr, 2024 activity report (in French).
• Human factor present in 68% of breaches: Verizon, 2024 Data Breach Investigations Report.
• French data breaches and advice on protecting yourself: CNIL, France Travail investigation and Cnaf, alert on stolen passwords (in French).