I changed all my passwords — am I safe?

Not yet. A stolen session cookie represents an already-established login: it keeps working after the password change, until the session is explicitly revoked. Look for "connected devices" or "active sessions" in each account's settings.

My antivirus flagged nothing.

That's possible: these programs are designed to run briefly then vanish, which leaves little time to be noticed. The absence of an alert proves nothing; your accounts' active sessions, on the other hand, can be checked.

Infostealer (credential-stealing malware)

In plain terms

A program that installs itself on your machine and empties, within seconds, everything your browser had remembered: saved passwords, open sessions, payment methods. You notice nothing, because there's nothing to notice.

Definition

An infostealer is malware whose sole function is to collect and exfiltrate credentials, session cookies, tokens, and payment data present on a device, then disappear.

How it works

Installation is voluntary from the system's point of view: an opened file, a fake update accepted, software downloaded outside an official store, a "free" game or utility. Once run, the program doesn't install itself durably and doesn't try to persist — it collects and it leaves, which is why no symptom appears. It targets the browser first, because everything is gathered there: saved passwords, stored bank cards, history, and above all session cookies. These last are the most valuable haul, since they represent an already-validated login: whoever replays them gets in without a password and without triggering two-factor authentication, which has already been passed. This is what most victims discover too late — changing the password isn't enough if sessions aren't revoked.

Warning signs

Logins to your accounts from an unknown device, with no password ever changed
Two-factor authentication that doesn't trigger even though a login happened elsewhere
Purchases or subscriptions using a card saved in the browser
Recent installation of free software, a cracked program, or an update offered by a webpage
Messages sent from your accounts that you didn't write

How to verify

Look at what was recently installed, and the extensions added to the browser. Then, in each sensitive account, open the list of sessions and connected devices: a session you don't recognize is the clearest sign, and the one a password change doesn't make disappear.

What to do

Only install software from the publisher's own site or an official store, and be especially wary of anything presented as the free version of paid software. Avoid saving your bank cards in the browser: it's the first place searched.

If it already happened

In this order, and from another device: revoke all active sessions on your accounts, then change the passwords, then regenerate backup codes. Revoking before changing is the order that matters, since a stolen cookie stays valid as long as the session isn't closed. Then have the machine scanned, and watch for payments over the following weeks.

Frequently asked questions

I changed all my passwords — am I safe?: Not yet. A stolen session cookie represents an already-established login: it keeps working after the password change, until the session is explicitly revoked. Look for "connected devices" or "active sessions" in each account's settings.
My antivirus flagged nothing.: That's possible: these programs are designed to run briefly then vanish, which leaves little time to be noticed. The absence of an alert proves nothing; your accounts' active sessions, on the other hand, can be checked.

Official sources

Cybermalveillance.gouv.fr — Assistance and reporting (French government cybersecurity assistance service)

This article is part of the Credentials and accounts family. Last updated: 2026-09-02.