Information-stealing malware is malicious code built to collect sensitive data from a victim system and send it to an attacker. The target data is usually credentials, session tokens, browser cookies, API keys, SSH keys, or other secrets that can be reused for account access or lateral movement.
It matters because a stolen token can be as useful as a password, and sometimes more so if it bypasses multi-factor controls. In real attacks, this malware may arrive through a phishing attachment, a fake installer, or a compromised software package. In development and cloud environments, it is especially dangerous when it runs on a machine that already holds build secrets or deployment credentials. Defenses focus on limiting what any process can read, using least privilege, rotating exposed secrets quickly, and monitoring for unusual file access, token exfiltration, or outbound connections from trusted tools.