Infostealer

You had two-factor authentication on, and the account was still taken. Often the culprit is not a guessed password but a small program that copied your logged-in session.

The short answer

An infostealer is malware that collects saved passwords, session cookies, autofill data and other secrets from a device and sends them to attackers [1]. A stolen session cookie lets someone use a web service as the logged-in user without the password, and it can bypass some forms of multi-factor authentication [3]. Microsoft names phishing, fake ads, cracked software and fake CAPTCHA pages among the ways the infostealer Lumma Stealer spreads [1]. Our assessment: after an infection, changing the password alone is not enough; you also have to end the active sessions.

How it works

1. What it collects. Microsoft describes Lumma Stealer as extracting saved passwords, session cookies and autofill data from Chromium-based and Mozilla browsers, plus cryptocurrency wallets, data from VPN, email, FTP and Telegram apps, and documents from the user profile [1].
2. Why 2FA does not help afterwards. A session cookie is set after you have signed in, including the second factor. If an attacker loads that cookie into their own browser, they can often continue the same session [4]. Google notes that stolen cookies keep working even after the malware has been detected and removed [7].
3. How it gets in. Lumma arrives through phishing emails, ads that imitate download pages, compromised websites, cracked versions of legitimate apps, abused public repositories and ClickFix [1]. Okta's researchers saw cookie-stealing malware spread through cracked games [4]. Our reading: free "unlockers" and cheat tools are the same bait in a different wrapper.
4. ClickFix. A fake error message or CAPTCHA asks you to paste a command into the Windows Run dialog, Windows Terminal or PowerShell; running it downloads the malware [2]. According to Microsoft, infostealers such as Lumma Stealer are among its payloads, and Lumma appears to be the most prolific final payload it has observed for this technique [2].
5. A traded product. Lumma is sold as malware as a service and has been marketed in underground forums since at least 2022 [6]. In May 2025, Microsoft's Digital Crimes Unit and partners took down about 2,300 domains of its infrastructure [6].
6. What browsers change. Google's Device Bound Session Credentials (DBSC) bind a session to a key in the device's TPM, so stolen cookies quickly expire; Google says DBSC entered public availability for Windows users in Chrome 146 [5]. It only protects sites that have added support for it [5].

A practical example

A friend downloaded a "free" version of a paid tool, and a day later their gaming and email accounts send spam. From a clean device, they first sign out of all sessions where the service offers it, then change the passwords, starting with the email account, and check the 2FA settings and recovery options. Okta points out that logging out invalidates the session cookie [4]. Only then do they clean or reinstall the infected PC; until then it keeps handing out new cookies. This is an illustrative scenario, not a case we handled.

Checklist

• Download software only from the vendor's own page, not from ads in search results [1].
• Never paste commands from a website into Run, Terminal or PowerShell [2].
• Avoid cracked games and apps; they are a known carrier [1][4].
• End all active sessions after a suspected infection, not just change the password [4][7].
• Use a clean device for the clean-up, and wipe or reinstall the infected one (our assessment).
• Keep the browser up to date so protections like DBSC can work where sites support them [5].