Stealer (from the English word steal, meaning «to steal») — is a malicious program that steals data from a computer or phone. It operates unnoticed: the person uses their device as usual, unaware that their data has already been stolen.
What a stealer collects:
-
logins and passwords saved in the browser;
-
cookies — which can be used to access an account without a password;
-
autofill information and bank card details;
-
access credentials for crypto wallets and messengers;
-
device information: IP address, operating system and computer specifications.
The program packs everything it finds into an archive and sends it to the attacker. Accounts accessed later using this stolen data are called logs and are resold.
How a stealer gets onto a device
A person unknowingly runs an infected file. A stealer can be disguised, for example, as:
-
cracked paid programs and «free» versions of useful software;
-
game cheats;
-
archives and documents in emails, such as a «technical brief» or «contract» in a collaboration proposal;
-
files from ads promising something free or an offer that's too good to be true.
There are also fake «I'm not a robot» checks that ask users to copy a command and run it on their computers. A legitimate CAPTCHA never requires this.
Stealers and traffic arbitrage
For an affiliate marketer, a stealer — is a direct threat. Their computer stores access credentials for ad accounts, other accounts, affiliate networks and crypto wallets. If these are stolen, an attacker can spend someone else's advertising budget, withdraw money or resell accounts. Some stealers specifically search for advertising and business accounts to run malicious ads from them and infect more people.
Affiliate marketers can encounter stealers bundled with cracked software: pirated antidetect browsers, trackers and activators. Saving money on a subscription can cost you all your accounts. Malicious browser extensions work in a similar way. They promise to simplify advertising tasks, such as removing verification prompts in ad accounts, but actually send logins, verification codes and other work-related data to scammers.
How to protect yourself
-
download programs only from official websites and don't install cracked antidetect browsers, trackers or other software;
-
install extensions only from reputable developers and check what permissions they request;
-
keep your work accounts and crypto wallet in a separate browser where you don't install random extensions or software;
-
don't open archives or files from strangers, even if they supposedly contain a technical brief or contract;
-
don't execute commands that a website or «robot verification» asks you to enter;
-
don't store passwords for important accounts in your browser;
-
install antivirus software and enable 2FA through an authenticator app.
Important: 2FA doesn't provide complete protection against stealers. If a stealer steals cookies, an attacker can access an account without a password or verification code: the website will recognize them as an already logged-in user. That's why changing passwords alone isn't enough if you suspect an infection. First, clean or reinstall your operating system, then change your passwords from another, clean device, starting with your email, and terminate all active sessions in the settings of every important account.
