Quick answer: infostealer malware quietly copies the session cookies and authentication tokens stored in a browser after someone logs in, then hands that data to an attacker who loads it into their own browser and is treated as an already-signed-in, already-verified user. No password is guessed, and no MFA prompt is bypassed in the technical sense, it simply never gets asked for again. Here’s how that works and what actually reduces the risk.
What infostealer malware actually does
Infostealers are small, purpose-built pieces of malware designed to grab whatever a browser or a handful of common apps have stored locally: saved passwords, autofill data, cryptocurrency wallet details, and, most consequentially, session cookies and authentication tokens for anything the victim was logged into at the time of infection. The data gets packaged up and sold in bulk on criminal marketplaces, often within hours of infection, frequently to whoever specializes in the next step of turning that access into money.
Why this bypasses MFA entirely
MFA protects the login itself, the moment someone proves who they are with a password plus a second factor. What it doesn’t protect, on most services, is the session that gets created afterward. That session is represented by a cookie or token sitting in the browser, and if an attacker copies that token and loads it into their own browser, most services have no way to tell the difference between the legitimate device and the attacker’s, because as far as the service is concerned, that user already proved who they are. The login step MFA was meant to guard never happens a second time.
How the malware actually gets onto a device
- Cracked or pirated software downloads, still one of the most common delivery methods
- Malicious ads for common business tools, appearing above legitimate search results
- Fake browser or software update prompts on compromised or malicious websites
- Malicious browser extensions installed outside any approved list
- Attachments disguised as invoices, resumes, or shared documents
What actually reduces this risk
- Endpoint detection and response on every device, not antivirus alone, since infostealers are built to slip past signature-based detection
- Restricting which browser extensions employees can install, and reviewing what’s already installed
- Shorter session lifetimes and forced re-authentication for sensitive actions, so a stolen token has a smaller window to be useful
- Dark web and credential monitoring, to catch exposure that’s already happened rather than assuming it hasn’t
- Treating a confirmed infostealer infection as a session compromise, not just a malware removal job, revoking active sessions and tokens, not only resetting the password
What this means in practice
MFA is still one of the highest-value security controls a business can enforce, this isn’t an argument against it. It’s a reminder that MFA protects one moment in a much longer chain, and an infected device downstream of that moment can undo it without ever touching the password or the second factor. See our write-up on MFA for why the type of MFA matters too, and our Managed Detection & Response and Dark Web Monitoring services for the two controls that catch this specific gap.