What’s Worth Stealing From an Ordinary PC? The “Already Logged In” Trap (Part 2)

“There’s nothing on my computer worth stealing.” It’s an easy thought to have when the news is full of cyberattacks on major corporations. No trade secrets, no confidential business plans, nothing a professional hacker would care about.

But what about your online shopping accounts, email, payment details, and the websites where you’re already logged in? Those can be valuable to criminals, too.

An ordinary home PC can be a worthwhile target. Worse, even if the malware disappears after stealing your information, the stolen data doesn’t magically come back. So what do infostealers actually take, and how much can a home-built monitoring tool reveal? We examined Microsoft’s findings and ran our own experiment on a Windows 11 PC.

More Than 394,000 Infected PCs: What Was Lumma Stealing?

On May 21, 2025, Microsoft announced an international operation to disrupt Lumma Stealer, a type of malware designed primarily to steal information rather than destroy files.

According to Microsoft, more than 394,000 Windows computers worldwide were identified as infected with Lumma between March 16 and May 16, 2025.

That’s a 62-day period. Dividing 394,000 by 62 gives approximately 6,355 computers per day.

But don’t mistake that calculation for a daily infection rate. It simply spreads the reported total across the observation period for comparison. It does not mean 6,355 new infections occurred every day, and the total includes more than just household PCs.

Microsoft’s technical investigation described a malware family capable of collecting saved browser passwords, session cookies, autofill data, cryptocurrency wallet information, and documents.

Lumma was also offered as malware-as-a-service. In other words, criminals did not necessarily have to develop their own information-stealing program. They could use an existing criminal service.

During the May 2025 disruption operation, approximately 2,300 malicious domains were targeted for seizure, suspension, blocking, or related action. That was a significant blow to Lumma’s infrastructure, but it did not mean the broader threat from information-stealing malware had disappeared.

Possibly Worse Than a Stolen Password: Being “Already Logged In”

Here’s the detail that caught our attention: sometimes a criminal doesn’t even need your password to get into an account.

The key is a session cookie. Websites use these small pieces of data for various purposes, including remembering that you’ve successfully signed in. Depending on the service and its security controls, a stolen authentication cookie may allow someone else to impersonate you.

On October 30, 2024, the FBI warned about criminals stealing cookies to access email accounts while bypassing multifactor authentication (MFA). This doesn’t mean every cookie can be used as a login credential, but certain authentication cookies can be extremely valuable.

Conceptual illustration of information that infostealer malware may target on a personal computer, including passwords, authentication cookies, payment details, documents, and cryptocurrency wallets. AI-generated illustration; it does not depict an actual infection or confirmed data theft.

Using the categories of information described in official security reports, we compared what their theft could mean for individuals and organizations.

Information stolen	Possible impact on individuals	Possible impact on organizations
Passwords	Unauthorized access to shopping or social media accounts	Compromise of work accounts
Authentication cookies	Email or other account hijacking	Unauthorized access to corporate cloud services
Payment and financial information	Fraudulent payments and financial losses	Misuse of corporate payment or expense information
Documents and configuration data	Exposure of personal information	Disclosure of customer data or business documents

Editor’s comparison based on categories identified in official security research. These are potential consequences, not a claim that every Lumma infection resulted in the theft of all these types of information.

The biggest difference between a personal and corporate victim may not be the type of data stolen, but how far the damage can spread. A personal PC used to access work accounts can potentially become a stepping stone toward an organization.

The Attack Doesn’t Have to Start With an Obvious Scam Email

Microsoft’s investigation found Lumma being distributed through several routes, including fake software download pages, malicious search advertisements, compromised legitimate websites, and pirated applications.

One particularly deceptive technique is called ClickFix. A website displays what looks like a routine CAPTCHA or troubleshooting prompt, then tricks the visitor into running a malicious command themselves.

That is a rather unpleasant twist. An attacker doesn’t always need to perform some spectacular technical break-in. Sometimes the victim performs what appears to be an ordinary computer task, and that action starts the infection.

Japan’s Information-technology Promotion Agency (IPA) included unauthorized online account access, online banking fraud, and misuse of credit card information among the threats affecting individuals in its Information Security 10 Major Threats 2026 report.

Unlike its list for organizations, the IPA’s individual-threat list is not ranked. It is presented in Japanese alphabetical order. The report provides a useful Japanese perspective on problems that also affect computer users elsewhere.

We Examined 10,765 Events on a Home PC. What Did We Actually Find?

Rather than stopping at security reports, we began building ZATSU GUARD, an experimental Windows monitoring tool developed with AI assistance.

We retained McAfee as the PC’s existing antivirus protection and used Microsoft’s Sysmon to record selected process and network activity. ZATSU GUARD collects and analyzes those records; it does not replace the antivirus software.

From November 9 to shortly after midnight on November 10, 2026, we collected and analyzed 10,765 Sysmon events on our test PC.

The recorded events broke down as follows:

Sysmon event	Recorded events
Process creation (Event ID 1)	5,366
Process termination (Event ID 5)	5,368
Network connection (Event ID 3)	23
DNS query (Event ID 22)	8
Total	10,765

Here’s our calculation:

(23 network events + 8 DNS events) / 10,765 total events × 100 = approximately 0.29%.

That leaves approximately 99.71% consisting of process creation and termination events.

But this is where the numbers need careful interpretation. The 0.29% figure describes the composition of the events our monitoring setup recorded. It is not the percentage of actual PC network traffic. The November 10 portion is also a partial observation ending at approximately 12:32 a.m. Japan Standard Time.

Breakdown of 10,765 Sysmon events collected and analyzed by ZATSU GUARD during part of November 9–10, 2026. The records included 5,366 process creation events, 5,368 process termination events, 23 network connection events, and 8 DNS queries. Network and DNS events represented approximately 0.29% of the recorded events—not 0.29% of all PC traffic, infections, or data leaks. The smaller bars are visually enlarged for readability; this is an illustrative chart rather than a strictly proportional plot.

In a separate test, ZATSU GUARD flagged a Microsoft update-related program for review. Further examination found a valid digital signature and a matching file hash. That was useful supporting evidence for legitimate software activity, not a guarantee that the program was safe in every possible context.

The exercise exposed an important limitation: recording a process and its network connections does not tell us exactly what information, if any, was stolen.

Some information-stealing malware can even remove itself after taking data. That means a monitoring tool focused only on programs hiding for several days could miss attacks that finish much sooner.

Can AI Help Defend a PC? Start With the Computer and Its Accounts

AI can help organize large collections of security events and assist with examining unusual connections or program behavior. That’s one of the goals behind ZATSU GUARD.

However, the tool remains experimental. At this stage, its suspicious-activity analysis is rule-based. It does not provide a finished AI-powered infection diagnosis or automatic malware removal system.

For ordinary users, the practical defenses still matter most: keep Windows and applications updated, maintain reliable antivirus protection, avoid suspicious download sites, and never run unfamiliar commands just because a website tells you to.

Accounts need their own protection. Use unique passwords, passkeys where available, and multifactor authentication. Remember, though, that stolen authenticated sessions may sometimes bypass the need to enter an MFA code again.

If you suspect an infection, avoid continuing to sign in to important accounts on the affected PC. From a separate trusted device, change the credentials for critical services such as email and banking, and revoke existing login sessions where the service allows it.

The affected PC should also be examined with trustworthy security software. If financial fraud is suspected, contact the relevant bank or payment provider.

Removing malware from a computer and protecting accounts whose credentials may already have been stolen are two different jobs. Doing only one of them may leave the other problem unresolved.

Editor’s Note

What bothered me most about this story wasn’t the number of infected computers. It was the realization that criminals aren’t necessarily interested in my computer at all. They want the digital identity I’ve conveniently left sitting inside it.

And apparently, even the fact that I’m already logged in can be worth stealing. We save these details because they make our lives easier. Naturally, they can make a criminal’s life easier too. There’s something annoyingly efficient about that arrangement.

Meanwhile, ZATSU GUARD has reached the point where it can organize more than 10,000 recorded events. That sounds impressive until you realize that a mountain of logs doesn’t automatically catch a thief. If the malware grabs what it wants and vanishes, watching for something that remains hidden for days may be the wrong place to concentrate all our efforts.

So perhaps the real project isn’t simply building a smarter PC watchdog. It’s figuring out where monitoring helps, where it doesn’t, and how to protect the accounts that a thief might have reached before the alarm ever sounded.

Our homemade security tool still has quite a long way to go.

Terms That May Need a Quick Explanation

References