One figure in the latest report from the CRIF Cyber Observatory, covering the first half of 2026, deserves more attention than it got: by number of accounts stolen through infostealers, Italy ranks third in the world, behind the United States and France. It’s sixth for email and password pairs in circulation and, overall, the number of unique records circulating on the dark web has reached 2.5 billion.
Wherever you live, the mechanism behind those numbers is the same, and it changes the rules of how you should protect yourself. Infostealers have become the cheapest way into people’s accounts over the past two years.
What an infostealer actually does
An infostealer is a program that, once run on a computer, does one thing in a few seconds: it collects everything the browser and some apps store and sends it to a criminal’s server. The haul usually includes:
- passwords saved in browsers;
- session cookies, the “tokens” that keep you logged in to websites;
- autofill data, including payment cards;
- sessions of apps like Telegram and Discord, and any crypto wallets;
- sometimes files from the Desktop and Documents folders.
Often the program then deletes itself. It doesn’t slow the PC, show windows or demand a ransom, which is why many victims notice nothing for weeks.
Why two-factor authentication isn’t enough
This is the surprising part. If a criminal steals your password, the SMS or app code stops them. But if they steal your session cookie, the website sees them as you, in your browser, already past the second factor. They need neither the password nor the code: they just “paste” the session into their own browser.
That’s why infostealer cases include social media and email accounts taken over even with two-factor authentication turned on. CRIF’s report confirms the trend: data stolen this way keeps growing, helped by the “stealer-as-a-service” model, where the malware is rented monthly like any subscription and requires no technical skill.
How it gets onto your computer
- pirated software and cracks: paid programs downloaded for free, Office activators, game cheats. It’s the classic entry point, and the reason so many victims are young;
- malicious search ads: you search for a well-known program and the first, sponsored result leads to a cloned site;
- fake “I’m not a robot” checks: a page asks you to press Win + R, paste some text and press Enter to “verify” you’re human. In reality you are running a command that downloads the malware. No legitimate site will ever ask you to do this;
- phishing attachments and links, often fake invoices or quotes in password-protected archives that slip past email antivirus scanning.
Warning signs
- alerts about sign-ins from a new device or another country, especially for several services at once;
- friends receiving messages from you that you never wrote;
- email settings changed, for example a forwarding rule you didn’t create;
- a notice that “your password appeared in a data breach” from your browser or password manager. According to CRIF, 32.3% of users of its Italian monitoring service received at least one alert in the half-year.
What to do if you suspect an infostealer
Order matters. If you change passwords from the infected PC, you may hand over the new ones too.
- Use a clean device, such as your phone, for everything that follows.
- Start with your main email account: every other account can be recovered from there. Change the password and immediately sign out of all active sessions. On Google it’s under Manage your account > Security > Your devices; on Facebook and Instagram under Accounts Center > Password and security > Where you’re logged in. This step, not the password change alone, is what makes stolen cookies useless.
- Continue with banking, social media and work accounts, again changing passwords and closing sessions.
- Clean the computer. An antivirus scan is the minimum, but with malware that deletes itself it offers no guarantees. The truly safe option is to save your documents and reinstall Windows from scratch.
- Tell your bank if you had a card saved in the browser, and ask whether it should be replaced.
Lowering the risk from now on
Three habits make the difference. First: no software from unofficial sources, not even “just to try it”. Second: use a dedicated password manager with auto-lock rather than saving passwords in the browser. Third: wherever available, switch to passkeys, which can’t be copied and reused like a password.
Passkeys don’t solve stolen cookies, but they close the most used door. And getting into the habit of signing out of accounts you rarely use, instead of staying logged in for ever, reduces what an infostealer can take.
Source: Teleborsa, data from the CRIF Cyber Observatory (first half of 2026).