Infostealer

What is an infostealer?
Infostealers are lightweight malware that silently extract passwords, session cookies, authentication tokens, autofill data, cryptocurrency wallets, and other sensitive information, then exfiltrate them to an attacker-controlled server. They are highly successful because most infections are self-inflicted, coming from users who intentionally execute fake installers, fake captcha prompts, cracked/pirated software, game mods, or "free" software that provide a pathway for the compromise to execute. Once executed, the malware exfiltrates everything instantly, leaving almost no artifacts for antivirus tools to detect. The reason is that they use native OS components and common tools built into each platform, such as PowerShell on Windows, bash, terminal, and osascript on macOS, along with curl on both platforms to collect and siphon credentials. These actions appear as normal user or system activity to virus/malware scanners both during and after execution. So don't bother wasting time on virus/malware scans, as they will likely find nothing.

For curious minds, I provided screenshots to show the anatomy and describe the workflow of a macOS infostealer variant at the end of this blog. If you have any questions, leave a comment and I will be happy to answer.

What is compromised?
Infostealers mainly focus on two things. The first is exfiltrating session cookies and authenticated tokens from the device they run on. The second is decrypting encrypted databases that contain passwords and other sensitive information from various locations. Both types of information are sent to a remote attacker‑controlled server. Whether you are on macOS or Windows, the first step always succeeds because it requires no user input and happens very quickly, so there is nothing a user can do to stop it. If your device is a Mac, the behavior is different due to macOS native protection. While session cookie exfiltration is successful on macOS, the malware needs the Mac user password for other things like decrypting password databases, crypto wallets, and similar items, so it will prompt you to enter your password. If you do not provide the password, the malware cannot steal your passwords or other sensitive data protected by the password. Aside from this, the infostealer also siphons out crypto wallet keys, TOTP seeds, API keys, SSH keys, and many other items, including installing background services. The last one listed requires doing a clean reinstall of the OS.

How to recover?
Before you proceed, I want to mention that these steps assume you discovered an infostealer compromise and have not taken any action yet. Most importantly, if you have already done step# 4 based on advice from elsewhere online or hearsay, you unfortunately missed the chance of potentially recovering from this compromise unscathed. In that case, you can skip step# 1 and 4 and follow the rest.

The recovery steps outlined below depend on the type of device the compromise was executed on. If the device is Windows, unfortunately both session cookies and all passwords, crypto wallet keys, and similar data are exfiltrated successfully. However, if the device is a Mac and you did not provide your password when prompted, you only need to recover from stolen session cookies. On the other hand, if you did provide your Mac password, the compromise is identical to Windows. I have dissected several variants of infostealers and found that architecturally they are all identical in how they operate, so the steps below apply to any variant. Follow the steps in the exact order specified to effectively recover from an infostealer compromise.

1. Revoke active sessions: This is the most critical step that most people miss. Unlike what many armchair experts advise on infostealer compromise, you should not waste time trying to find a clean device for this step because it is time sensitive. Just do it right on the compromised device without disconnecting from the internet as soon as you realize you are a victim of an infostealer. The reason I recommend using the same device is because not all online services provide a way to log out from all devices, and your main goal is to revoke the stolen session cookies, not the session cookies on other devices that are not stolen  and are perfectly fine. If a service does not provide a logout‑from‑all‑devices option, your attacker will keep access to that service for a long time until the stolen session cookie naturally expires, which can take hours, days, or even weeks. So it is very important to use the same compromised device for this step. The actual step to revoke the session is simply logging out from every service on that device, which makes the stolen session cookies useless to the attacker. Do not do anything else on that device. Once you have logged out of all services, turn off the compromised device.

2. Change password: This step must be done using a device that is not compromised, or on your compromised device if you have already reinstalled the OS as described in step 4 below. Login to each of your online accounts and change your password or optionally change to a passphrase. While changing your password, if the service offers an option to log off all devices or anything similar, make sure to do that as well. Also, enable 2FA if not enabled already, preferably an authenticator app or hardware key-based method rather than SMS. Make sure there are no email forwarding rules in your email accounts. Setup a recovery email if there is not one already and finally, regenerate the backup codes. 

3. Backup: Backup your documents, photos, and other data. Infostealers cannot damage them and do not even target that type of content. They are perfectly fine to backup and restore after the next step. You only need to worry about your primary drive where the operating system resides. Your external drives are fine because infostealers do not interact with them as far as I know.

4. Reinstall OS: If your compromised device is a PC, create a bootable media. It can be a USB stick or secondary SSD with an installable OS obtained directly from Microsoft. Now go to your compromised device BIOS settings and enable booting from the alternate drive, the USB or secondary SSD, and choose to do a complete wipe and reinstall of Windows on your primary SSD or hard drive. For a Mac, boot into recovery mode, choose Disk Utility, and select the top-level internal disk to erase. Follow that by selecting reinstall macOS. If you are unsure how to do this, there are plenty of tutorials on YouTube you can follow to accomplish this step. 

5. Browser Extensions: This would be a good time to review all your browser extensions, delete the ones you do not use, and validate the ones you use regularly. Most people have no idea how much access they grant to browser extensions or how dangerous they can be. I highly recommend reading this blog that explains the details. https://blog.selvansoft.com/2026/05/browser-extensions.html 

6. Safety Tips: Follow as many online safety tips as possible from the blog link below. The more of them you follow, the stronger your online safety becomes. https://blog.selvansoft.com/2025/01/online-safety-tips.html  

7. Monitor: Monitor your credit cards, online banking, and similar financial accounts. Optionally, I recommend freezing your credit following this guide: https://blog.selvansoft.com/2023/05/howto-credit-freeze.html 

8. Advice: Stay away from installing stuff from random websites. You can assume all free/pirated software has some form of malware. There is no such thing as a safe website to download free stuff. It just does not exist, regardless of what you heard or what your buddy online told you about a software from a site being safe.

Anatomy of a macOS Infostealer Variant

Stage 0: This is the initial stage that downloads the base64-encoded Stage 1 payload. It executes when the victim runs the initial code on terminal or powershell, initiating the compromise. The decoded script is shown in the Stage 1 screenshot below.

Stage 1: In this stage, basic data such as the victim's external IP, hostname, and OS version is collected and sent to the remote server to download the Stage 2 script, which performs the actual compromise. Note: Most variants stop here if they detect a Russian keyboard.

Stage 2: This is where the actual compromise occurs. A large osascript payload is downloaded and executed inline. I have not shown the full script since it is over 1200+ lines, but if the victim sees the highlighted message box, it is game over!

---

Stay Informed and Safe Online

If you enjoyed this blog, you'll find many more cybersecurity related microblogs at link below. They offer valuable insights to help you stay informed and safe online. Explore them at https://blog.selvansoft.com. Also, checkout free online security tools at https://selvansoft.com/tools/

Browser Extensions

 

We rely on browser extensions for convenience, but most people have no idea how much access they grant. This blog post highlights why that kind of blind trust can be dangerous.

Problem:
Browser extensions are extremely powerful because they run inside your active web sessions. When you grant an extension permission to read or change data on the sites you visit, you are giving it access to your digital life. That convenient ad blocker or productivity tool you have installed can do serious damage including reading your passwords. Most extensions people install require broad access to function, especially ad blockers. Extension stores like the Chrome Web Store do scan for spyware, but malicious plugins still slip through. Many of us practice good cyber hygiene with strong passwords, 2FA, and password managers, but when it comes to browser extensions, people often overlook the risk and trust the developer or the store without thinking. The real danger is that extensions operate natively inside the browser, so their actions look completely legitimate to security tools.

Solution:
If you install browser extensions, and most people do, ask yourself whether you truly need them and whether the risk to your online data is worth it. If you cannot live without an ad-blocker extension, which is true for almost all users, consider using DNS‑level ad blocking with something like Pi‑hole instead of a browser extension. DNS‑based blocking works across all devices on your network rather than on each device or browser separately. A much safer approach is to keep a separate browser with zero extensions installed for sensitive tasks like banking or email. I follow this myself in addition to using Pi‑hole for network‑wide ad blocking.

Working demonstration:
To show how dangerous extensions can be, I wrote a working browser extension (link below) that you can install. If you are curious, try it and see the level of access a browser extension actually has.

Extension Telemetry Demo

The screenshot below is from this extension running in my Chrome browser, showing what it captured, including the username and password I typed while browsing a website. You will notice it also captures live network data, form fill data, and more.

FAQ:

Here are some FAQs on this topic. If you have a question that is not covered in this list, feel free to post a comment and I will try to answer it.

Q. Every website uses HTTPS these days, which is fully end-to-end encrypted. That means I am safe from browser extensions reading my data, right?

A. No. A browser extension sees your data before it is encrypted. It reads everything in plain text long before HTTPS comes into action.

Q. I always use a VPN. That means extensions cannot read my data, right?

A. No. Same answer as before. Extensions see everything in plain text before the VPN comes into action. Speaking of VPNs, many misunderstand what a VPN is and assume it is a security solution. It is not. Read my VPN blog here https://blog.selvansoft.com/2024/06/vpn-myth-vs-reality.html to learn more.

Q. If I only install extensions with good reviews, that means they are safe, right?

A. No. Malicious extensions often start clean to build trust, then update themselves later with harmful code once they have a large user base.

Q. If an extension is open source, that means it is safe, right?

A. Not necessarily. Most people never review the source code, and even if they do, the published code may not match the code that was actually packaged and uploaded to the store.

Q. If I install an extension from a well‑known company, I should be safe, right?

A. Usually safer but not guaranteed. Large companies have had compromised developer accounts and supply‑chain attacks. Trust helps, but it is not absolute protection.

Q. If I disable an extension on certain websites, it cannot read anything from those sites, right?

A. Not always. Some extensions request broad permissions that allow them to run everywhere, even if you manually toggle them off on specific sites.

Q. If I use private browsing or incognito mode, extensions cannot access my data, right?

A. Not exactly, but you can still grant them access. If you enable an extension in incognito mode, it has the same visibility as in normal browsing.

Q. If I uninstall a suspicious extension, I am safe again, right?

A. It stops future access of course. However, a malicious extension could have already captured data or exfiltrated information before you removed it.

---

Stay Informed and Safe Online
If you enjoyed this blog, you'll find many more cybersecurity related microblogs at link below. They offer valuable insights to help you stay informed and safe online. Explore them at https://blog.selvansoft.com. Also, checkout free online security tools at https://selvansoft.com/tools/

Online Safety Tips

This blog is intended for both general and technical audiences. While the tips outlined below are basic things everyone should already be aware of, following as many of them as possible will significantly reduce your risk of becoming an online victim. First, using common sense is your primary line of defense in staying safe online. Trust your instincts, be cautious of unfamiliar websites or emails, and think twice before sharing personal information on social media. Common sense can go a long way in protecting you online. In addition to using common sense, adhere to the following guidelines to enhance your online safety.

• Passwords: Use long, complex passwords and change them regularly. Passwords with special characters are hard to remember or type unless you use a password manager. If you are comfortable with a password manager, use one, but password managers come with their own set of issues that I will not go into detail here. Instead, I strongly recommend using a passphrase rather than a traditional password. For example, a passphrase like "Sun Milk Bike $100" is easy to remember but much harder to crack. Passphrases are more resistant because of their length and higher entropy (the measure of unpredictability). The sheer number of possible word combinations dramatically increases entropy, making them extremely difficult to crack. You are welcome to use the passphrase generator I created and personally use at https://selvansoft.com/passphrase/. Last but not least, opt-in to passkeys when offered, but do not assume passkeys solve all your password problems, they don't. While they make authentication very secure and convenient, they do not magically prevent account compromise. Read this blog (https://blog.selvansoft.com/2025/01/passkey-practical-or-premature.html) for a deeper explanation of passkeys and their limitations as of this writing.
• Multi-Factor Authentication (MFA): Wherever possible, use more than just a password to secure your accounts, commonly referred to as two-factor authentication (2FA). Most websites provide multiple options for MFA these days. Always choose an OTP authenticator or hardware key-based authenticator if those options are offered and avoid SMS-based 2FA at all costs.
• Account Recovery: It is very important to set up account recovery for your Gmail, Apple, and Microsoft accounts. Make sure account recovery is set up with recovery codes, your phone, and most importantly, a different email that you never use for anything else but account recovery.
• Web browsing: Always ensure the website you visit uses the HTTPS protocol, especially when entering sensitive information. While all modern browsers enforce this and provide warnings, be attentive to these warnings and refrain from using any website that does not use HTTPS protocol or, worse, provides a mismatched SSL certificate, which is a red flag for a phishing attempt.
• Online Banking: Before logging in to your banking website for financial transactions or to review your bank statement, close all tabs in your browser. If you are particularly cautious, temporarily disable any browser plugins you may have installed, which you can turn back on later. When you are logged in to your banking website, do not do anything else, such as performing a Google search, browsing Facebook, Instagram, or any other sites. Specifically, avoid reading emails or, worse, clicking on a link your buddy sent you to "check it out." Once you are done with your online banking, make sure to log off. Many secure banking websites these days do protect you by logging you off automatically. However, don’t rely on them because there are still some online banking websites that don’t properly log you out in a reasonable time or, worse, don't do anything.
• Public Wi-Fi: When using public Wi-Fi, avoid logging into sensitive accounts or performing financial transactions. It is safer to wait until you are connected to a trusted network. This also applies to smartphones even if they are not on public Wi-Fi, because cellular data networks are shared by thousands of devices on the same carrier network, which can increase exposure to risk. For additional details, read this blog (https://blog.selvansoft.com/2026/07/is-public-wi-fi-safe.html) for a deeper explanation of public Wi‑Fi safety.
• Enable Firewall: Ensure your device's firewall is enabled. Most operating systems come equipped with a built-in firewall, so enable it and block all inbound connections. Keeping your firewall enabled is a simple yet effective way to bolster your security on any network, public or private.
• DNS: Don’t use the default DNS servers provided by your ISP (Internet Service Provider). Instead, use any of the following DNS servers: 1.1.1.1, 8.8.8.8, or 9.9.9.9. You can follow this link (https://www.tomsguide.com/us/cloudflare-dns-1.1.1.1-set-up,news-26964.html) that walks you through how to change DNS on various devices.
• Antivirus and Anti-malware Software: Keep them updated to protect your device from threats.
• Phishing Scams: Be skeptical of emails or messages with links or attachments that urge immediate action or ask for personal information. If it sounds too good to be true or creates a sense of urgency, it's likely a scam.
• Links: Avoid clicking on random links or scan random QR code regardless of who sent them to you. However, there may be legitimate reasons to click a link; for example, confirming your email for a new account signup or completing authentication for a website, etc. In such circumstances, right-click the link and select "Open Link in Incognito Window" (if you are using the Chrome browser) or use a similar feature available in your preferred browser if it is not Chrome. Last but not least, I recommend reading this QR code safety blog (https://blog.selvansoft.com/2025/01/qr-code-safe-to-scan.html) to stay informed about the dangers associated with QR codes.
• Installing Software: Only download and install software from reputable sources. Avoid pirated software and gaming cheat codes, as they almost always contain malware and viruses.
• Software Update: Regularly update your operating system, browsers, antivirus definitions and apps to protect against security vulnerabilities. 
• App Permissions: Check the permissions granted to apps and revoke any that are unnecessary.
• Personal Information Sharing: Be mindful of what personal information you share online. Don’t overshare on social media and be wary of websites or services asking for more information than necessary.
• Monitor Your Accounts: Regularly check your bank and credit card statements for any unauthorized transactions.
• Credit Freeze: Add a credit freeze to all major credit bureaus. There is no need for your credit report to be in an "unlocked" status unless you are applying for a loan, bank account, credit card, etc., which you don’t do every day. So, why does it need to be in an "unlocked" status? When you need it, you can unlock your credit report, get your business done, and lock it back. Follow this blog (https://blog.selvansoft.com/2023/05/howto-credit-freeze.html) that walks you through the credit freeze process.
• Backup: Regularly back up your data to an external hard drive or a cloud service.
• Educate Yourself: Stay informed about the latest cybersecurity threats and how to protect yourself. There are a lot of useful cybersecurity FAQ’s documented in this blog (https://blog.selvansoft.com/2024/09/cybersecurity-faq.html) 
• Trust Your Gut: If something feels off or too good to be true, it probably is. Your intuition can be a powerful tool in staying safe online. 

---

Stay Informed and Safe Online

If you enjoyed this blog, you'll find many more cybersecurity related microblogs at link below. They offer valuable insights to help you stay informed and safe online. Explore them at https://blog.selvansoft.com. Also, checkout free online security tools at https://selvansoft.com/tools/

Is your computer compromised?

Easy way to check if your computer is/was compromised now or in the past

With the recent addition of Naz.API dataset (a massive collection of over 1 billion stolen username and passwords) to HIBP service ("Have I Been Pwned" - a service by troyhunt.com), it is now very easy to check if your computer is compromised by information stealing malware now or in the past. 

Go to the HIBP service at https://haveibeenpwned.com and enter your e-mail (don’t worry, it is 100% safe) and check the search results. The results may span several pages, so make sure to scroll down and check all the breaches your email is listed as compromised. Keep in mind that it is not at all unusual to see your email show up on multiple breaches. For example, see the screenshot below of my own email search.

As you scroll through the list, check if your email is listed for Naz.API. If your email was one of the unfortunate one to be included in the Naz.API list, it is a clear indication that your computer is now or in the past was compromised and information was stolen. The very least you can do is to make sure your current password is not included in the list. There are couple of ways you can check. I know some password managers like 1Password for example can check all your passwords against HIBP database. If you don’t use any tools that support checking your password in HIBP database you are welcome to use my php script at my GitHub repo below which does the same thing, the only caveat is that it checks one password at a time against HIBP database, so you have to repeat that for all your passwords.

https://github.com/aselvan/scripts/blob/master/security/pwned_password.php

How to run: If you are on a Mac or Linux, you can run the script directly with the two commands as shown below ... If you are windows, you have to install php, curl etc first which is beyond the scope of this blog.

curl -s https://raw.githubusercontent.com/aselvan/scripts/master/security/pwned_password.php -o /tmp/pwned_password.php

php /tmp/pwned_password.php

If you are unfortunate to have your password listed in HIBP as per the tools (1Password or my script or any others that check your password against HIBP), and if it is any of your current passwords, change it ASAP and enable 2F if that’s not already in place. If your current password is not found, it means an old password you used in the past was compromised. Still, it is a good idea to change all your passwords ASAP.

If you use more than one email address now or in the past, repeat this for each e-mail.

For further details can be found at the following links

• https://www.bleepingcomputer.com/news/security/have-i-been-pwned-adds-71-million-emails-from-nazapi-stolen-account-list/
• https://www.troyhunt.com/inside-the-massive-naz-api-credential-stuffing-list/

Stay Informed and Safe Online

If you enjoyed this blog, you'll find many more cybersecurity related microblogs at link below. They offer valuable insights to help you stay informed and safe online. Explore them at https://blog.selvansoft.com

New Year, New Password!

As part of your new year’s resolution, it is a good idea to get your online security a fresh start in 2024. With cyber threats becoming an unfortunate norm these days, it's time to enhance your cyber hygiene to protect yourself from becoming a cybercrime victim this year. Change all your online account passwords, especially financial/banking, shopping, social media accounts. The following is a list of things to consider.

• Change your passwords (also change username if permitted)
• Enable password-less logins if available.
• If you don’t have 2F enabled, make sure to enable it.
• If the site supports stronger 2-factor mechanisms, like Authenticator app or better yet hardware key based, use that instead of SMS based 2-factor; While SMS based is better than just password alone, it is prone to attacks like SIM swap scams 
• Validate your recovery mechanisms.
• Reset recovery app keys (if any)
• Validate recovery e-mail.
• Reset onetime login codes.
• Last but not least, invalidate all logins (i.e. log out from all devices and log back in). Though this step may be enforced by the password change, some sites don’t enforce it.

Remember, cyber hygiene is like flossing, not the most glamorous, but essential for long-term digital health. This year, make your online security a resolution you actually stick to. Have a safe 2024 and beyond!

Related Link: https://blog.selvansoft.com/2022/06/deterministic-password-manager.html

Stay Informed and Safe Online

If you enjoyed this blog, you'll find many more cybersecurity related microblogs at link below. They offer valuable insights to help you stay informed and safe online. Explore them at https://blog.selvansoft.com. Also, checkout free online security tools at https://selvansoft.com/tools/

Three Simple Online Banking Safety Tips

Here are three simple steps you can take while doing online banking to minimize your chances of becoming a victim. As the title says, these steps are simple and does not take much time or effort to follow.

1. Before login to your banking website for financial transactions or to even review your bank statement etc., close all tabs in your browser. If you are paranoid, temporarily disable any browser plugins you may have installed which you can turn on later.
2. When you are logged into your banking website, do not do anything else like google search, Facebook, Instagram, or any other browsing specifically, read emails or worse, click on a link your buddy sent you to "check it out". You can do all that after step#3 below.
3. Once you are done with your online banking business, make sure to log off. Many secure banking web sites these days do protect you by logging you off automatically. However, don’t rely on them because there are still some stupid online banking web sites that don’t properly log you out in a reasonable time or worse, don't do anything.

---

Stay Informed and Safe Online

If you enjoyed this blog, you'll find many more cybersecurity related microblogs at link below. They offer valuable insights to help you stay informed and safe online. Explore them at https://blog.selvansoft.com

Simple Cyber Hygiene Practice

Here is some advice on simple cyber hygiene practices to protect yourself online. You really don't have to take extreme steps to bulletproof your online accounts because if a persistent and determined cyber criminals decided to target you (i.e., spear phishing), there is very little you can do to stop them especially if you are a high value target. Luckily most of us don't fall into that category unless you are dumb enough to divulge your personal info by posting on social media that makes you a target. However, with a bit of effort on your part, you can make it slightly harder for cybercriminals to scam you so they will move on to easy targets. 

"You don’t have to run faster than the bear to get away. You just have to run faster than the guy next to you."

Trust me, there are still stupid people out there who use "123456" as password (BTW: "123456" is one of the top 10 passwords in 2022 including "password") feeding this fast growing $8 trillion cybercrime business. 

Now, how do you make it "slightly harder"? The answer is, as you may have heard many times, don't just rely on user/password alone even if you have a strong password like "~ti0ah5%#W". Though a strong password is the first step in making it harder, it does not always protect you in all cases as there are ways criminals find a way to gain access to your stuff. So, ensure that you enable 2FA (two factor authentication) wherever it is offered. If multiple methods are provided for 2FA like SMS & authenticator, choose the latter as SMS based 2FA is a false sense of security though it is better than just user/password.

---

Stay Informed and Safe Online

If you enjoyed this blog, you'll find many more cybersecurity related microblogs at link below. They offer valuable insights to help you stay informed and safe online. Explore them at https://blog.selvansoft.com