PSW.Stealer (Trojan-PWS) - what it steals and how to remove it

PSW.Stealer (Trojan-PWS)

What it is

A password-stealing trojan for Windows that harvests credentials and other sensitive data, then exfiltrates it to the attacker. See our overview for defenders for details.

Why it matters

Once stolen, credentials enable account takeovers, lateral movement, and fraud. One infected endpoint can compromise many services.

What it targets

  • Browsers: saved logins, cookies, autofill, sessions

  • Mail/FTP/VPN clients and RDP credentials

  • Messengers and gaming platforms

  • Crypto wallets and seed phrases

  • System info, screenshots, clipboard

How it spreads

Malspam with fake invoices or delivery notices, cracked software, malicious installers, poisoned search results, and drive-by downloads via shady sites and push-notification scams.

How to spot it - quick checks

  • Sudden loss of saved logins or new logins from unknown locations

  • Unfamiliar processes in %AppData%, %LocalAppData%, or Temp

  • New autoruns: Run keys, Scheduled Tasks, Startup folder

  • Outbound connections to paste sites, file hosts, or Telegram/Discord webhooks

  • AV logs flagging “Trojan-PWS,” “Stealer,” or credential-dump attempts

What to do

  1. Disconnect from the network and isolate the host.

  2. Collect a triage pack: running processes, autoruns, network connections, recent downloads.

  3. Remove persistence and delete the payload; run a full anti-malware scan.

  4. Reset all passwords from a clean device and revoke tokens/sessions.

  5. Rotate MFA secrets where possible and invalidate remembered devices.

  6. Review accounts for unauthorized activity and enable alerts.

  7. Reimage if integrity is uncertain.

Limits to know

  • Many stealers are modular - payloads can fetch keyloggers or RATs later.

  • Cookie/session theft can bypass passwords and some MFA until tokens expire.

  • Post-cleanup, credentials may still circulate on forums - keep monitoring.

    Glossary (A–Z)

    All A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

      • Related Articles

      • General Data Protection Regulation (GDPR)

        What it is The GDPR is the EU’s data privacy law. It sets clear rules for how organizations collect, use, share, and store personal data - and gives people strong rights over their information, no matter where a company is based if it serves EU ...

      • LokiBot (Loki Password Stealer)

        LokiBot (Loki Password Stealer) What it is LokiBot is a credential-stealing trojan that targets Windows and Android. It grabs passwords, cookies, and wallet data, can take screenshots, and sometimes opens a backdoor for more malware. Technical ...

      • Qbot (QakBot)

        Qbot (QakBot) What it is Qbot - also known as QakBot - is a modular banking trojan targeting Windows. It steals credentials, cookies, and session tokens from browsers and mail clients, monitors web logins with injects, and can log keystrokes. ...

      • Data Exfiltration

        What it is Data exfiltration is the unauthorized transfer of your data out of your device or network—quietly slipping customer records, passwords, designs, or finances to an attacker. It’s the punchline of many breaches: get in, get data out, cash ...

      • Data Breach

        What it is A data breach is when someone gets into a company’s systems without permission and steals sensitive info—customer names, emails, passwords, payment details, medical records, and more. For overview: see our data breach guide How it happens ...