A fresh report from NordVPN finds a worrying trend for people who keep apps and browsers “always logged in.” The report warns that infostealer malware operators are shifting tactics and are no longer focused solely on stealing passwords.
If you stash login data in your browser, keep streaming apps signed in across devices, install shady extensions or “free” software, you may be handing cybercriminals everything they need to take over accounts, impersonate you, or sell your access to other criminals.
To uncover how this shift is happening, NordVPN experts analyzed data from 10,000 of the most frequently mentioned domains found in infostealer malware logs worldwide throughout 2025 (nearly 500 million infostealer logs in total). For the data set, the researchers analyzed infostealer logs collected on the NordStellar platform from January 1 to December 31, 2025.
The study found that cybercriminals are increasingly targeting the active sessions and login data that keep users automatically signed in to services like Netflix, Hulu, and beyond. While evolving away from blunt password-grabs, attackers are most eager to exploit saved logins, browser cookies, autofill data, and always-on sessions, many cord cutters rely on for convenience.
“When we look at the apps and websites most often linked to infostealer infections, three clear user patterns emerge. They are so common that almost anyone can become a victim, including IT professionals,” says Marijus Briedis, CTO at NordVPN.
The Three Victim Profiles Criminals Love (and Why)
NordVPN’s analysis shows three clear lifestyle/behavior clusters that appear repeatedly in infostealer log data an the “always-logged-in” lifestyle is a theme that runs through all of them.
- Lifestyle / heavy social media & streaming users — the largest single cluster.
- Why they’re targeted: Social platforms, streaming services, and shopping sites produce dense, monetizable session data. The report links roughly 65 million logs to social platforms (Facebook, Instagram, Discord, X) and ~28 million logs to streaming services (Netflix, Disney, HBO). Stolen sessions can give attackers access to email, payments, and account recovery flows without cracking a password.
- Gamers — the second largest group
- Why they’re targeted: Gaming ecosystems often rely on launchers, store accounts, and in-app purchases tied to stored payment methods. The report found over 53 million logs, and risk compounds because gamers download mods, unofficial launchers, or cracked content that are frequent infection vectors for infostealer campaigns.
- IT professionals — a high-value but smaller cluster.
- Why they’re targeted: With about 27 million logs, the report found tools and portals used by IT staff, including cloud code hosting, identity portals, remote admin pages, and enterprise apps. A compromised browser session on a machine used for devops or admin tasks can cascade into serious internal access.
As Briedis puts it: “Infostealers are designed to grab saved logins, credentials, browsing data, and active sessions without you knowing. The more your device remembers for you, the more it can give away in seconds.”
How Infostealers Get on Devices — The Attack Chain
For distribution and tactics, NordVPN’s research is clear about the top routes attackers use. Malvertising and fake download pages, cracked/pirated installers and game mods, malicious browser extensions, shared files and links in chats, and loader networks that rent out installs to criminals round out the list.
Once executed, infostealers quietly scrape browsers, apps, saved passwords, cookies, and tokens, pack that data into logs, and ship it to criminal panels for resale or follow-on attacks. The rise of multifactor authentication (MFA) and password managers is a key reason cybercriminals have moved on from plain password theft to stealing session cookies and tokens that keep you logged in, according to the study.
If stolen, the analysis found that attackers can access accounts without reauthentication or MFA, which remain usable until revoked or expired, giving attackers time to move through services. When sold, the stolen session data with fresher logs fetches higher prices. Plus, infostealer operations are often run as “malware-as-a-service,” making them cheap and scalable for criminals to deploy at volume.
When Convenience Creates Security Gaps
If you’re juggling streaming services, family device access, and browser extensions that promise “better streaming,” you create the precise environment the study flags. Though studies have found that Americans are becoming more privacy-aware, habits like saving credentials, accepting all cookies, or skipping extension audits still leave gaps that attackers exploit.
The “accept all cookies” pattern can let trackers, and indirectly, attackers gain more access to your browser state. It’s a small convenience with a measurable downside, especially for people relying on free/ad-supported TV. With compromised cookies from free streaming sessions, hackers can alter account settings, track you across devices, and charge premium fees. Put simply, the same behaviors that optimize your streaming experience can also hand attackers the session data they need.
Another growing social‑engineering tactic involves fraudulent delivery and scam webpages designed to harvest users’ personal data. A previous study by NordVPN found an 86% surge in malicious postal service websites, ahead of the 2025 holiday season. By luring people into clicking links or installing content that looks legitimate, cybercriminals use fake sites to distribute infostealers. Stay vigilant when shopping online by double-checking the URL in the address bar and purchasing from verified retailers.
10 Tips to Protect Yourself Online Today
Staying safe online doesn’t require a complete overhaul of your habits, but it does demand a little more awareness. It isn’t about paranoia. By pairing everyday common sense with a few practical steps highlighted in NordVPN’s research, you can significantly reduce your exposure to infostealers and other cyber threats.
- Sign out of devices you don’t use. Go into your streaming app settings and remove unfamiliar or idle devices. Treat “stay signed in” as a convenience, not a default.
- Enable MFA for your main email and any account that controls payments or password resets. This blocks the majority of account takeovers, even if tokens are stolen.
- Audit and remove unused browser extensions (especially anything promising “free streaming,” “screen fix,” or unofficial streaming features). Extensions can access cookies and sessions.
- Delete unnecessary stored passwords from browsers. Use a reputable password manager for unique logins instead. Password managers reduce the surface area and generate hard-to-guess credentials.
- Avoid cracked software and “free” premium tools. If it’s not from an official source, don’t run it. Remember, cracked installers are a top infection vector.
- Be skeptical of lookalike download pages and ads. Check the URL, prefer official vendor pages, and don’t click “download” buttons in sponsored results without verifying the site.
- Use a modern antivirus/endpoint tool on family/shared Windows machines and keep OS/apps patched. Many infostealers rely on unpatched environments.
- Split accounts where possible. Keep critical accounts (email, banking) separate from entertainment accounts and avoid storing payment details in low-security apps.
- Limit cookie permissions and block trackers where possible. Don’t reflexively choose “accept all.” That behavior has privacy consequences and can amplify tracking/attack surface.
- Check account activity regularly (payment history, device list) and change passwords immediately if you see unexplained access.
Build a Safer Cord Cutting Setup & Pair Smart Habits With Smarter Protection
Beyond research, NordVPN offers trusted privacy and security that helps reduce everyday online risks for many cord cutters. NordVPN encrypts your internet traffic, helping protect your data from snoops on public Wi-Fi and unsecured networks. These are the most common weak spots when streaming, shopping, or managing accounts away from home. With servers in 178 locations across 129 countries, it also gives users fast, reliable connections without sacrificing performance.
Beyond basic VPN protection, NordVPN includes Threat Protection Pro, which blocks malicious websites, trackers, and intrusive ads, and scans downloads for malware before they can infect your device. Plus, it features Email Protection, a real-time link scanner that flags suspicious URLs inside emails. Other features like Double VPN, Onion Over VPN, and optional dedicated IPs add extra layers of privacy for users who want stronger control over their online footprint.
With plans as low as $3.39 per month, new subscribers can grab 24 months of NordVPN for up to 74% off and claim an Amazon Gift Card worth up to $50 for a limited time. Plus, it includes a 30-day money-back guarantee, so you can try it risk-free. Combined with smart habits like MFA and fewer saved logins, NordVPN can be a powerful part of a safer, more secure cord cutting setup as infostealers increasingly spread through fake downloads, malicious ads, and compromised links.