iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Protecting yourself from infostealer malware requires two separate plans: keep malware off the device, and assume that both saved passwords and active login sessions could be exposed if an infection occurs. Use a different, long password for every account; store those passwords in a reputable password manager; turn on multifactor authentication (MFA), preferably with a security key or authenticator; and use passkeys where they fit your devices and recovery plan.
If you suspect an infection, stop using the affected device for account recovery. From a device you believe is clean, change passwords, secure your email first, sign out other sessions or revoke tokens, remove untrusted browser extensions, update or reset the affected computer as needed, and involve your organization’s security team for work accounts.
What infostealer malware can take
An infostealer is malware designed to collect data already available on a device. In a browser-focused attack, that can include saved usernames and passwords, autofill information, browser profiles, and authentication cookies. The last item is easy to underestimate: a cookie can represent an already authenticated session, so an attacker may not need your password to enter an account.
The Cyber Safety Review Board’s 2023 Cyber Safety report documents the theft and monetization of authentication cookies through infostealer malware. Microsoft guidance for confirmed session-cookie theft likewise treats tokens as a separate incident from ordinary password exposure.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Passwords and sessions are different exposures
Changing a password addresses the password itself. It does not prove that an attacker’s existing session cookie has expired or been revoked. An account can therefore remain accessible to an attacker after you complete a password change if the provider leaves earlier sessions active.
Use this distinction when deciding what to do:
- Saved password exposed: change it, and change it on every account where you reused it.
- Active session or token exposed: use the account’s “sign out of all devices,” session management, token revocation, or equivalent control.
- Both may be exposed: perform both actions from a clean device, then finish cleaning or resetting the original device.
Build protection before anything goes wrong
Keep the operating system, browser, and extensions current
Apply operating-system and browser updates promptly. Remove extensions you no longer need, and install new ones only from the browser’s official store or a source you can verify. An extension has access to browser data according to the permissions it receives; an extension you do not recognize should be treated as untrusted until you establish where it came from and why it is installed.
Do not run pirated software, “cracks,” unsolicited installers, or attachments that ask you to bypass security controls. Infostealers are often delivered as apparently useful programs or files, so reducing untrusted execution is more effective than relying on a single security setting.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteUse a unique password for every account
The Federal Trade Commission (FTC) recommends strong, unique passwords and notes that a web browser, mobile browser, or password manager can save them. A password manager can generate a different random password for each site, so a theft from one service does not automatically unlock another.
Prioritize uniqueness for email, financial services, cloud storage, social accounts, and any account that can reset other passwords. If you currently reuse a password, create a change list and replace it everywhere; changing only the most important copy leaves the other accounts exposed to credential stuffing.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Turn on MFA, choosing the strongest practical method
MFA adds a second proof of identity, but its resistance to phishing and account takeover varies by method. The FTC and the Cybersecurity and Infrastructure Security Agency (CISA) both encourage MFA, with stronger options such as authenticator apps or security keys when an account supports them.
| Method | Phishing resistance | Practical considerations |
|---|---|---|
| FIDO2 security key | Strongest among the options listed here because the key verifies the legitimate site | Requires a compatible account and device. Keep a spare key or another recovery method; a lost, unreplaced key can lock you out. |
| Authenticator app code or approval | Stronger than text or email codes, but codes can still be phished | Protect the phone and plan how you will recover access if it is lost or replaced. |
| Text message or email code | Weaker; codes can be intercepted, redirected, or entered into a phishing page | Use when better methods are unavailable, and secure the underlying phone number or email account. |
MFA does not stop an infostealer from running, and it cannot by itself undo theft of an already authenticated session. It reduces the value of a stolen password and makes new sign-ins harder.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Consider passkeys with a recovery plan
Google describes passkeys as a way to sign in without a password. A passkey is tied to the site or app for which it was created, which makes it resistant to the look-alike-domain trick used by many phishing attacks. Passkeys can be stored in a password manager, synchronized across devices, or held on a physical security key, depending on the service and your chosen storage method.
| Credential approach | Phishing resistance | Works across devices? | Sync and recovery questions |
|---|---|---|---|
| Unique passwords in a password manager | Depends on the site and your ability to avoid phishing; the manager may match credentials to the intended site | Usually, if the manager supports your devices | How is the manager account recovered, and is its own MFA protected? |
| Synced passkeys | High against site-impersonation phishing because the credential is site-bound | Often, subject to the provider’s supported platforms | Which devices can restore the passkey, and what happens if the account or sync device is lost? |
| Local passkey on one device | High against site-impersonation phishing | No, unless the service offers another copy or enrollment | A lost or damaged device may make the passkey unrecoverable. |
| Passkey on a hardware security key | High against site-impersonation phishing | Only where the key is present and supported | Keep a spare key or an explicitly configured alternative recovery method. |
Before moving an important account to a passkey, open its recovery settings and confirm that another trusted device, a spare key, or another documented recovery method is available. Availability, synchronization, and recovery are controlled by the account provider and storage method, not by passkeys as a universal standard.
Understand what your browser protects—and what it cannot
Chrome documents protections such as matching autofill credentials to their intended websites, identity confirmation in some situations, and encryption whose details depend on the operating system and settings. These controls can prevent accidental entry on a look-alike site and protect data at rest under some conditions.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
They are not proof that browser storage is safe from malware running on a compromised or unlocked computer. Malware operating with access to your user profile may be able to read data after the browser has decrypted it for use. Treat browser protections as one layer, not as a substitute for device security, account MFA, or incident response.
Decide where credentials are stored
Chrome supports Google Password Manager, local profile storage, and physical security keys for passkeys. Check which option is active on each device and how it is recovered. A credential stored only in one local profile has a different failure mode from a credential synchronized through an account or held on a spare hardware key.
CISA’s recommendation to disable browser password saving is directed at managed organizational environments and policy enforcement. It should not be generalized into a universal consumer rule. For a personal device, the relevant questions are whether credentials are unique, whether the storage is protected by a strong device login and account MFA, and whether you have a recovery plan.
Protect the device and its stored data
CISA notes that malware may access, read, edit, steal, or deny access to data stored on a device. Enable full-device encryption where your operating system provides it, use a strong screen lock, and keep secure backups of important files. Backups and encryption reduce damage to stored data, but they do not replace password changes or session revocation after a suspected infostealer.
Signs that justify an immediate check
No single symptom proves an infostealer infection. Take the possibility seriously when several of these occur together:
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- A new browser extension or application appears without a clear reason.
- Security software or browser protections were disabled unexpectedly.
- Accounts show unfamiliar sign-ins, changed recovery details, sent messages, or new sessions.
- Saved credentials disappear, browsers behave unexpectedly, or a device has unexplained pop-ups and redirects.
- An installer, attachment, or pirated utility recently requested unusual permissions.
Account alerts can be the first reliable evidence because an attacker may use a stolen cookie without changing your password. Review security activity and recovery methods for unfamiliar changes even when the computer appears normal.
What to do when you suspect an infection
Sequence matters. Do not use the potentially infected computer to change the very accounts you are trying to protect.
- Move account recovery to a clean device. Use a phone or computer you believe is not infected. If you cannot identify one, ask a trusted person or your organization’s IT team for help.
- Secure your primary email first. Email often controls password resets for other services. Change its password to a new, unique value, enable the strongest available MFA, and inspect forwarding rules, recovery addresses, phone numbers, and active sessions.
- Change exposed passwords. Work through financial, work, cloud, social, and other high-value accounts. Change every account that used the same password, not merely the account that sent an alert.
- Revoke sessions and tokens. Use each provider’s account-security page to sign out other devices, remove unknown sessions, revoke refresh tokens, or disable connected applications. Microsoft’s guidance for confirmed session-cookie theft specifically calls for resetting credentials and disabling or revoking tokens; consumer labels and controls vary by provider.
- Review account activity. Look for unfamiliar sign-ins, devices, recovery changes, mail rules, API keys, app authorizations, and sent messages. Remove changes you did not make and save evidence needed by your provider or employer.
- Disconnect the suspect device from sensitive work. Stop using it for banking, email, password-manager access, and administrative tasks until it is cleaned or reset.
Remove browser persistence
Google’s malware-cleanup guidance recommends removing extensions you do not trust. In Chrome, open the three-dot menu, choose Extensions, then Manage extensions; remove anything unfamiliar or unnecessary. Do not merely disable an extension you believe is malicious if removal is available.
Reset browser settings when unwanted changes continue. A reset can restore the default search engine, startup pages, and other settings, but it does not prove that the operating system is clean. Reinstall only extensions you can identify and still need.
Recommended Free Tools
Update or reset the computer
Install all operating-system updates and restart. If signs of malware continue, Google’s guidance says you may need to reset the computer or ask the manufacturer for help. A reset can remove persistent software, but first preserve essential personal files using a safe process and make sure you know the recovery credentials for your operating system and accounts.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
After a reset, update the system before restoring applications, reinstall software from legitimate sources, and restore only files you trust. Recheck browser extensions and account sessions rather than assuming the reset automatically signed attackers out.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Account recovery priorities and special cases
When a password was reused
Make a complete inventory of every site that used the exposed password. Change each one to a separate generated password, then update the password manager record. Pay special attention to an email address used as a username on multiple services.
When a session cookie may have been stolen
A password change alone is insufficient evidence of containment. Sign out all sessions and revoke tokens where possible. If the account offers no obvious control, contact its support team and state that an authentication session may have been stolen. Continue monitoring sign-in alerts after the change.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsWhen the account is managed by an employer or school
Contact the organization’s IT or security team immediately. They can invalidate sessions centrally, rotate credentials, inspect endpoint telemetry, and preserve evidence. Do not attempt an independent forensic investigation on a work device or delete logs the team may need.
When a passkey or security key is lost
Use the provider’s documented recovery method, then review and remove the lost credential from the account. If you have a spare key or another enrolled passkey, use it to sign in and register a replacement. Do not assume every passkey is synchronized or recoverable; local and hardware-key credentials may be unavailable after loss.
Common mistakes that prolong an incident
- Changing only one password: reused credentials and active sessions remain exposed.
- Changing passwords on the infected computer: the new credentials can be captured again.
- Confusing MFA with session revocation: MFA protects many new logins but may not eject an attacker who already has a valid cookie.
- Keeping an unknown extension “just in case”: remove untrusted extensions before continuing normal browsing.
- Restoring every old application after a reset: a malicious installer can reintroduce the problem.
- Relying only on backups: backups help recover files, not stolen credentials or tokens.
- Assuming a browser password manager is either perfectly safe or always unsafe: its protections and risks depend on the browser, operating system, settings, device access, and whether malware is already running.
A practical protection checklist
- Install operating-system and browser updates.
- Remove extensions and applications you do not recognize.
- Use a long, unique password for every account.
- Store generated credentials in a password manager protected by strong MFA.
- Enable a FIDO2 security key or authenticator method where supported; use text or email codes when those are the only choices.
- Adopt passkeys only after confirming synchronization and recovery options.
- Use device encryption, a strong screen lock, and secure backups.
- Know where each important account manages active sessions and token revocation.
- If infection is suspected, recover accounts from a clean device and secure email first.
- For work devices and accounts, involve IT or security staff immediately.
How to judge whether you are contained
You have a stronger basis for containment when the suspect device has been cleaned or reset, all reused and affected passwords have been replaced, MFA is active, unknown recovery changes and app authorizations are removed, and every available session or token has been revoked. Continue watching account-security notifications because session theft and password theft can occur together, and providers differ in how quickly they invalidate existing sessions.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
