Saved passwords are an infostealer's first stop: why browser password managers are a client risk

Passwords saved in the browser are one of the first things infostealer malware collects, usually as soon as it runs. Chrome and Edge encrypt saved passwords, but malware running as the signed-in end user has repeatedly found ways to read them. For small business clients, the safer setup is to turn off password saving in the browser, move business credentials into a business password manager or single sign-on, clear what's already stored, and watch for reused and breached passwords.

How do infostealers take saved passwords?

Infostealers are built for one job, which is to collect everything valuable from a device and send it to the attacker in one pass. They usually arrive through a fake installer, a cracked app, or a ClickFix page that tricks the end user into running a command. Saved browser passwords are near the top of their list, alongside session cookies and crypto wallets.

Browsers do protect that data. On Windows, Chrome historically relied on an operating system feature that protects data from other users on the device, but not from malicious apps running as the signed-in end user. Google added App-Bound Encryption in Chrome 127 in July 2024, starting with cookies, and said it intended to extend the protection to passwords. Google was clear about the limits. Malware can still get around it by running with admin rights or by injecting code into Chrome.

Attackers adapted quickly. Within about two months, several infostealer families claimed working bypasses, and new ones keep appearing. In March 2026, researchers described VoidStealer, which attaches to Chrome as a debugger and reads the decryption key from memory, with no admin rights or code injection.

The takeaway for MSPs is simple. Browser encryption raises the cost of theft, but it isn't a reason to keep business passwords in the browser.

Why is this worse for small clients?

The same malware hits a 15-person firm harder than an enterprise, for four reasons.

• Passwords get reused. The password for the accounting portal is often the password for the bank, the payroll site, and a personal shopping account. One stolen list opens all of them.
• Personal and business profiles mix. An end user signed in to a personal browser profile can sync work passwords to a personal account, and then to a home laptop the MSP doesn't manage.
• Shared accounts are common. A single login for the supplier portal or the shared mailbox, saved in several browsers, multiplies the places it can be stolen from.
• Nobody knows what's saved. Without a business password manager, there's no list of which credentials exist, who has them, or which ones to change after an incident.

An infostealer on one device can then become a breach across several systems, with no clear way to tell which passwords to reset first.

What should clients use instead?

Take business passwords out of the browser and put them where they can be managed. For most small clients, that means five changes:

1. A business password manager. Company-owned vaults with shared folders for shared accounts, admin recovery, and the ability to remove access when someone leaves.
2. Single sign-on where possible. Every business app connected to Microsoft 365 or Google Workspace is one fewer password to store, steal, or reuse.
3. Phishing-resistant MFA, starting with admins and finance. Passkeys and security keys make a stolen password far less useful on its own.
4. Password saving turned off in the browser. Block the browser from offering to save new passwords, and clear what's already stored once end users have moved to the password manager.
5. Monitoring for weak, reused, and breached passwords. Flag them to the end user when they sign in and to the MSP in reporting, so they get changed before an attacker uses them.

The order matters. Turning off browser saving before a password manager is ready simply pushes end users toward sticky notes and spreadsheets.

How do you roll this out without locking end users out?

Move passwords first, then close the browser vault. A rollout over about a month works for most small clients:

1. Week 1, measure. Turn on monitoring for weak, reused, and breached passwords. The results give the client a concrete reason to change, and show which end users and apps need attention first.
2. Week 2, set up the replacement. Deploy the business password manager, connect the apps that support single sign-on, and create shared folders for shared accounts.
3. Week 3, move and announce. Help end users import their work passwords into the password manager, and tell everyone the date browser saving turns off.
4. Week 4, close the browser vault. Block the browser from saving new passwords, then clear stored passwords from managed browsers.
5. Ongoing, clean up. Have end users change any password flagged as breached or reused, starting with email, banking, and admin accounts, and review the numbers monthly.

Admins and finance staff go first at every step. Their passwords open the most doors.

How does Atakama help?

The browser hardening rule in Atakama can block managed browsers from saving new passwords and can clear stored passwords and other sign-in data after a set period, closing the browser vault once the client is ready. Credentials Analysis checks passwords against breach data and flags reuse across sites, using hashes rather than storing passwords. Credentials risk warnings alert end users when they sign in with weak, shared, breached, and reused passwords, and SaaS login controls can block business credentials from being entered on sites that aren't approved, including phishing pages.

Atakama’s scheduled Client Health Report adds a credentials page listing the most at-risk users and at-risk passwords ranked by severity, with one fix per user. For MSPs, that turns password hygiene into a monthly line item the client can see improve.

FAQ

Is it safe to save passwords in Chrome or Edge?

For business accounts, it's not the safest choice. Browsers encrypt saved passwords, but infostealer malware running as the end user has repeatedly found ways to read them. A business password manager with single sign-on and MFA is safer.

What do infostealers steal from browsers?

Saved passwords, session cookies, autofill data such as addresses and card details, and sometimes crypto wallets. Session cookies are especially dangerous, since they can let an attacker into an account without a password. For more, see why MFA alone doesn't stop session hijacking.

Should MSPs turn off the browser password manager?

Yes, on managed devices, once a business password manager is in place. Turning it off first, without an alternative, pushes end users toward less safe habits.

Does App-Bound Encryption stop infostealers?

It makes theft harder and noisier on Windows, but it isn't a complete fix. Google noted that malware running with admin rights or injecting into Chrome can get around it, and infostealers have shipped bypasses since it launched.

How do you find reused or breached passwords at a client?

Check the users’ passwords against breached data and compare them across sites, without storing the passwords themselves. Then prioritize changes for email, banking, and admin accounts.

Keep reading

For related threats, see how infostealers are harvesting AI logins and API keys, how ClickFix and fake AI installers work, why MFA alone doesn't stop session hijacking, and our page on credential theft prevention.

Sources

• Google Security Blog, Improving the security of Chrome cookies on Windows, July 2024
• BleepingComputer, Infostealer malware bypasses Chrome's new cookie-theft defenses, 2024
• Computerworld, Chrome encryption bypass discovered: new malware steals passwords and cookies, March 2026