Accounts being taken over one after another, logins from places you’ve never been, or a warning that your details turned up in “stealer logs”? Password-stealing malware, known as an infostealer, may be the cause. Answer eight quick questions to see how likely that is, then follow a recovery plan in the order that actually works. Your answers never leave this page.
Your result
What pointed us there
Your recovery plan: do it in this order
-
1. Clean the infected device first
Back up your personal files (documents and photos, not programs), then reset or reinstall the operating system. With an infostealer it's the only way to be sure it's gone.
Run a full scan with a reputable scanner (for example Windows Security's full and offline scans, or Malwarebytes), uninstall anything you don't recognise and remove unknown browser extensions. If the scan finds an infostealer, reset or reinstall the device.
Until the device is clean, don't log in to anything on it. New passwords typed on an infected device are stolen again within minutes.
-
2. From a clean device, change your passwords
Use your phone or another computer you trust. Start with your email account (it can reset everything else), then banking and payment accounts, then everything else. Give every account its own password; our password generator makes strong ones.
-
3. Sign out of every session, everywhere
Infostealers copy login cookies, which let criminals into your accounts without your password or two-factor code. Changing a password doesn't always end those sessions, so sign out of all devices on each service. Also delete app passwords, API tokens and connected apps you don't recognise. Tick off each service below as you go.
-
4. Move any crypto to a brand-new wallet
Treat any seed phrase or wallet file that was on the infected device as stolen. On the clean device, create a new wallet with a new seed phrase and move your funds there. Changing the wallet's password isn't enough.
-
5. Watch for fraud over the next few months
Turn on transaction alerts with your bank and card providers, check statements, and run our free dark web scan to see which breaches include your email. If your ID or card numbers were on the device too, our alert checklist walks you through what to do.
Sign-out checklist
Links go to each service's own security page; some ask you to log in first. Only tick the ones you use.
Runs in your browser. Your answers never leave this page; only your checklist ticks are saved, in this browser, until you clear them.
Password & Username GeneratorWhat an infostealer does
An infostealer is malware built to grab everything useful from a computer in a few seconds: passwords saved in your browser, login cookies, autofill data such as addresses and card details, crypto wallet files, and sometimes screenshots and documents. It packs them into a “log” and sends it to the criminal. Many don’t even stay on the device afterwards.
Those logs are sold in bulk on dark web markets and Telegram channels, often within hours. Buyers search them for email, bank, crypto and gaming accounts. Our guide to infostealer logs explains the trade in detail.
How people get infected
- Cracked software and game cheats. “Free” versions of paid apps, game mods and cheats, and key generators are the most common source.
- Fake “verify you are human” pages. A page tells you to press Win + R (or open Terminal), paste something and press Enter. That pasted command installs the malware. No real captcha ever asks for this.
- Links in videos, ads and chats. Fake software downloads promoted in video descriptions, search ads and Discord or Telegram messages.
- Malicious browser extensions and fake updates. “Your browser is out of date” pop-ups and extensions that ask for far more access than they need.
Why the order of the steps matters
The usual advice after a hack is “change your passwords”. With an infostealer, doing that first can make things worse: if the malware is still on the computer, every new password you type is captured and sent straight back. So the device comes first, then passwords (from a clean device), then sessions.
Sessions matter because infostealers also copy your login cookies. A stolen cookie lets a criminal open your account as if they were already logged in, with no password and no two-factor code. That’s how accounts with two-factor turned on still get taken over. Signing out of every session on each service makes those cookies useless. Read more in how stolen cookies bypass 2FA.
After you’ve finished the plan
Make every password unique with our password generator, preferably stored in a password manager rather than your browser. Switch to an authenticator app, security key or passkey for important accounts. Run our free dark web scan to see which breaches include your email, and keep an eye on bank and card statements for a few months.
This self-check is a guide, not a diagnosis: it can’t see your device. If you’re unsure, a reputable antivirus scan or a professional repair service can confirm an infection.
Infostealer FAQ
How do I know if I have an infostealer?
Often you don't: they're designed to run quietly and some delete themselves once they've sent your data. The clues are what happens next: accounts taken over one after another, logins you don't recognise, two-factor codes you didn't request, drained crypto wallets, or a monitoring service telling you your details were found in stealer logs.
Will an antivirus scan remove it?
A full scan with a reputable scanner catches many infostealers, and you should run one. But if the scan finds one, or the signs are strong, resetting or reinstalling the device is the only way to be sure. Back up your documents and photos first, not programs or installers.
Why shouldn't I change my passwords straight away?
Do it straight away, but from a different, clean device such as your phone. If you change passwords on the infected computer, the malware can capture the new ones as you type them.
I have two-factor authentication. How did they get in?
Infostealers copy login cookies, the small files that keep you signed in. With a stolen cookie, a criminal can open your account without your password or a two-factor code. Signing out of all sessions on each service ends that access.
Does this tool save my answers?
No. Your answers are only used on this page to work out the result. The only thing saved is which checklist items you ticked, in this browser's own storage, so you can come back to the list. The "Clear my progress" button deletes it.
What if my crypto was stolen?
Assume the seed phrase or wallet file was copied. On a clean device, create a brand-new wallet with a new seed phrase and move anything left there straight away. Report the theft to the exchange and the police; recovery is rare, so beware of anyone offering to get it back for a fee, which is a common follow-up scam.