Credentials can be collected
Saved passwords, browser autofill, cookies and authentication data may expose several accounts at once.
Technology, platforms and channels
Malware and infostealers: what they take and what to do
Malware is software created or used to damage, disrupt, spy on or gain unauthorised access to devices and data. Infostealers specialise in collecting valuable information such as passwords, browser data, sessions, files and cryptocurrency details.
Page T-012Guidance pageReviewed 29 August 2026
Key Guidance
A password change may be necessary, but it is not enough if the device or an active session remains compromised. Contain the suspected device, recover important accounts from a trusted device and confirm whether data or access was taken.
Start with Key Guidance for the short answer. Then read the sections that match what happened and what you need to do.
Understand the issue
Why this matters to you
The visible symptom may be a pop-up, slow device, unfamiliar login or account loss—or there may be no obvious symptom. The response must address both the device and the accounts used on it.
Sessions can be stolen
An active browser session may sometimes be reused without entering the password again, so changing a password alone may not close every route.
Files and identity data can be taken
Documents, screenshots, messages, wallets and locally stored information may support later fraud or impersonation.
Malware can spread or disrupt
Some infections move across connected systems, encrypt files or damage the services people and organisations depend on.
Consequences and movement
What may happen next
Treat signs as prompts for investigation, not as a diagnosis. Fake security warnings can themselves try to make you install malware or pay for unnecessary support.
Unfamiliar account activity
New sessions, password resets, messages or transactions can show that stolen access is already being used.
Browser or device changes
Unexpected extensions, redirects, security settings or software may indicate unwanted access, though each can have other causes.
Follow-up impersonation
Collected information can make later calls, emails or account messages unusually specific.
False technical support
A pop-up or caller may invent an infection and direct you to remote-access software, a payment or another malicious download.
Practical response
What you should do
Contain first, then recover through a device and route you trust. Avoid entering new passwords into the suspected device until it has been assessed or rebuilt safely.
- Disconnect when active harm is suspectedIf malware appears to be spreading, encrypting files or controlling the device, disconnect it from networks and removable storage without erasing evidence unnecessarily.
- Use a trusted deviceRecover email, banking and other high-value accounts from a different device that you reasonably believe is safe.
- End unfamiliar sessionsReview signed-in devices, revoke sessions and remove unknown recovery details, app passwords, forwarding rules and connected applications.
- Change exposed credentialsReplace passwords that were stored or entered on the device, starting with email and financial accounts, and enable strong multi-factor authentication.
- Assess and clean the deviceUse trusted security guidance or professional support. A full reset or rebuild may be more reliable than removing one visible file.
- Check for consequencesReview transactions, messages, cloud files and account changes. Preserve evidence and contact providers promptly if access, money or identity data was misused.
Look more closely
Malware can create continuing access after the first installation
The original download may be only the beginning of the exposure. The software may capture accounts, sessions, files or activity over time, so recovery should address the device and every valuable service that may have been reached through it.
A link, attachment, advert, update, cracked software or support call introduces the file or action.
Curiosity, urgency, access, a prize or a security warning makes installation seem useful.
The file appears to be a document, installer, browser tool, update or legitimate support program.
Execution, permissions or remote access creates the route into the device.
Sign-in details, sessions, files, wallets, payments and device control can all be taken.
Selected history
Historical cases and lasting lessons
Credential and session theft
Infostealer campaigns have used malicious downloads and compromised websites to collect browser and authentication data for resale or later account intrusion.
Lasting lesson: Account recovery must close sessions and restore device trust, not only change one password.
Malware delivered through familiar content
Malicious files and links are routinely disguised as invoices, applications, updates, media or required workplace documents.
Lasting lesson: Safety depends on layers of protection and trusted routes, not blaming a person for one click.
Transferable understanding
Patterns over time
No symptom does not mean no exposure
Information-stealing malware may aim to stay quiet long enough to collect valuable data.
One device can expose many services
Browsers and password stores concentrate access, making prioritised account recovery essential.
Fake and real warnings can look similar
Do not let the warning control the support route. Reach the provider or trusted security service independently.
Defence works in layers
Updates, backups, limited privileges, multi-factor authentication and monitoring reduce different parts of the risk.
Plain-language answers
Common questions
Is changing my password enough?
Not if the device, browser session or recovery route remains compromised. Secure the device and revoke active access as well.
Should I use the infected device to change passwords?
Prefer a separate trusted device. New sign-in details entered on a compromised device may also be captured.
Does a pop-up prove I have malware?
No. False alerts often try to sell support or cause a download. Close the route and use trusted device or provider guidance.
Should I delete everything immediately?
Contain active harm first. If the incident matters to an employer, insurer or investigation, preserve evidence and follow specialist guidance before wiping the device.
Contain, recover and report
Use trusted technical support for the device and the official recovery routes for affected accounts. Contact financial providers at once for transactions or disclosed banking access.
Scamology Insights
Follow the exposure beyond the download
These apps, tools, books and courses can help you connect an unexpected file, download or support request with the access it may create. They also show where trusted contact details or containment steps can stop further harm. Links are intentionally withheld in this production version.
Continue understanding
Explore related guidance
Evidence and currency