Stealer

Expanded Definition

A stealer is a category of malware designed to silently collect information from an endpoint and transmit it to an attacker. The term usually refers to commodity malware sold or rented in criminal ecosystems, and its value lies in speed, stealth, and broad credential harvesting rather than visible disruption.

Stealers are commonly aimed at browsers, password stores, crypto wallets, session cookies, and locally cached tokens or certificates. That makes them especially effective against accounts protected by strong passwords alone, because they often bypass the login step by stealing an already authenticated session. In practice, the boundary between “password theft” and “session theft” matters: a stolen cookie can be more immediately useful than a stolen password if the session remains valid.

Definitions in the industry are fairly consistent, but the operational emphasis varies. Some reporting treats stealers as a subset of infostealers, while others use the terms interchangeably. The practical meaning is the same: malware built to exfiltrate sensitive access material with minimal user-visible impact.

Examples and Use Cases

Stealers show up in several common compromise paths and are usually just the first stage of a broader intrusion.

• Browser credential theft, where saved usernames, passwords, and autofill data are copied before the user notices anything unusual.
• Session-cookie theft, where attackers reuse a live browser session to enter a service without triggering a fresh login challenge.
• Crypto-wallet targeting, where locally stored wallet files, seed material, or exchange credentials are harvested for fast monetisation.
• Developer workstation compromise, where API tokens, SSH keys, and cloud console sessions are collected from browsers, files, or local storage.
• Initial-access resale, where harvested credentials are packaged and sold to other actors who use them for follow-on intrusion or fraud.

One important tradeoff is that stealers are often optimised for broad collection, not precision. That makes them noisy in the back end, even when they are quiet on the endpoint, because the attacker may receive more credentials and tokens than they can immediately use. For defenders, this means the real risk is often delayed and distributed across many downstream accounts rather than tied to a single infected machine.

Security Implications

The main security impact of a stealer is not the infection itself but the loss of trust in whatever secrets were present on the endpoint. Once credentials, cookies, or tokens leave the device, the attacker can often bypass normal authentication controls and act as the user until those artefacts are revoked or expire.

This creates a fast-moving blast radius: email, SaaS, VPN, cloud, source control, and wallet access can all be exposed from one compromise. It also undermines incident detection, because stolen sessions may look like legitimate activity rather than a fresh login from a suspicious host. In environments with weak session governance, a stealer can remain useful long after the original malware is removed.

NHIMG research highlights how persistent this problem can be, with Ultimate Guide to NHIs noting that 79% of organisations have experienced secrets leaks, and 77% of those incidents caused tangible damage.

Practitioner observation: if an endpoint is confirmed to be infected, the response should assume that browser sessions and cached tokens are compromised even when password resets appear successful.

Security, Operational and Governance Implications

Stealers matter because they convert endpoint compromise into identity and access compromise very efficiently. The attacker does not need to break cryptography or defeat a mature password policy if the endpoint already holds usable session material, browser credentials, or API keys.

That changes governance priorities. Organisations need to treat endpoints as potential secret stores, not just user devices, and they need revocation paths that can invalidate sessions, tokens, and other cached access artefacts quickly. Where credential rotation is slow, the attacker’s window of opportunity stays open even after the malware is eradicated.

For operations teams, the best signal is often not the malware family name but the pattern of downstream misuse, such as impossible travel, unusual token reuse, or unexpected access from a normal-looking account. Stealers are successful when defenders assume authentication equals trust; in reality, stolen sessions can make an attacker look perfectly legitimate.

Related resources from NHI Mgmt Group

• How do security teams know if macOS stealer defences are actually working?
• Why do modular malware-as-a-service campaigns create a broader identity risk than a single stealer binary?
• How do security teams know if stealer detection is actually working?
• Why do malicious patches in wallet and key-derivation code create higher risk than a typical postinstall stealer?