What to do when a Trojan steals saved passwords

A browser password manager can expose far more than website passwords. A Trojan in the same browser profile may copy unlocked vault data, autofill identities, payment details, and synced credentials. Removing one suspicious extension or changing a single password will not contain the breach.

When a Trojan steals your saved passwords from the browser's password manager, act from a known-clean device. Secure email and financial accounts first, remove the malware, revoke active sessions, and only then rebuild the password setup.

Make urgent changes from a clean device

Disconnect the affected computer from the internet, Wi-Fi, and external drives. Do not use it to change passwords or sign into email. For a managed device, tell IT or your security provider before anyone deletes files or resets it.

Use an updated device you trust, such as a separate laptop or personal phone, to change important credentials. Start with email because it controls password resets for many other services. Never use a public or shared computer for banking.

Action	On the infected device	On a separate clean device
Change passwords	Risks handing new credentials to the Trojan.	Allows password changes without exposing new credentials.
Review activity	May show altered data or live attacker sessions.	Provides a more reliable view of account activity.
Clean the device	Spreads access and delays containment.	Permits scanning while the infected device stays isolated.

If no separate device is available, borrow a trusted one and update it first. A mobile device may be safer than an unknown public machine, but do not use it if it shows the same signs of infection.

Protect email, banking and government accounts

Change the email password, then the account used by your browser's password manager. Update Microsoft, Google, or Apple accounts that sync passwords, followed by banking, social media, cloud storage, and shopping accounts. Use unique generated passwords and enable multi-factor authentication wherever offered.

Common Australian targets include ATO, MyGov, Medicare, online banking, and superannuation portals such as AustralianSuper or REST. Contact each institution using the number on its card or official Australian website, never a link in an alarming message, and ask the bank to check for unauthorised transactions.

Revoke browser sessions and synced access

In the browser's security settings, sign out all sessions, remove unknown devices, and review recovery details. Reset the password-manager master password if it may have been exposed, turn off emergency access, and enable multi-factor authentication on the sync account. Check for unfamiliar third-party apps with account permissions.

Revoke active sessions before changing individual site passwords where the service allows it. Deleting saved entries does not invalidate copies already stolen or terminate an attacker's session. A fresh master password and revoked sessions are separate layers of protection.

Remove the Trojan and stop persistence

Treat malware removal as a separate job. Keep the device isolated, use updated and reputable security software, and scan both the device and any removable drives. On Windows, Safe Mode can help expose persistent startup items; on macOS, remove suspicious browser extensions and login items without running scripts from unknown sites.

Cleanup advice for potentially unwanted programs can help with bundled adware or fake security tools that make the infection difficult to control. Remove anything you did not install deliberately, then reboot and scan again to confirm persistence has gone.

This applies whether the computer is a personal laptop used around Melbourne or a company system in Sydney. Involve IT before wiping a business device, since logs may be needed for an incident report or insurer.

Recover encrypted files without paying twice

If files or backups were encrypted too, keep those drives disconnected and never overwrite them. When malware encrypts backup files, preserve an untouched copy and validate known-good backups before restoring. Paying does not guarantee a usable key, and a decryptor from an unknown seller adds another risk.

Restore only after the Trojan is removed. Work from offline or immutable copies, confirm that files open correctly, and contact your IT provider or cyber insurer if business records are affected. Do not reconnect encrypted backups to a device that still contains the malware.

Assess identity theft and Australian reporting

Watch for delayed misuse. Review bank and card transactions, ATO and MyGov notices, new email forwarding rules, password-reset messages, and unfamiliar devices. Report suspicious activity promptly, replace exposed cards where advised, and keep screenshots of alerts and case numbers as evidence.

Australia's OAIC and the Privacy Act 1988 may be relevant if personal information was accessed and there is a reasonable chance of serious harm; assess the notification rules rather than assuming every infection qualifies. The Australian Cyber Security Centre's ReportCyber service can provide guidance for reporting and containment.

Rebuild a safer password setup

After cleanup, sign into the browser only on the clean device. Restore or recreate trusted entries, generate a distinct password for every account, and use a reputable password manager or hardware-backed passkeys where supported. Keep operating systems and extensions updated, and enable login and new-device alerts.

For continuing malware prevention guidance, Pc Malware Expert offers practical advice on safer browsing and recovery. Maintain offline backups, avoid reused credentials, and never install a password tool advertised by a pop-up. Trust is rebuilt through verified accounts, revoked sessions, and a device you can actually control.