In lesson 2 you switched on two-step login. Brilliant. Today's lesson is about the one trick that can get round it, and how easy it is to avoid.
Many website hacks don't start on the website at all. They start on the laptop or phone you use to log in.
The culprit is a type of malware called an infostealer. In the first half of 2026 alone it infected 7.4 million devices and stole 1.7 billion logins. Here's how it works:
- Someone installs a "free" program, a cracked app or a dodgy browser extension, or clicks a fake update.
- In seconds, the infostealer copies every password saved in the browser, plus the "stay logged in" sessions.
- Those logins are sold online, often within hours.
- A buyer uses your live session to walk straight into your website, email or hosting. Because you're already logged in, two-step login is never asked.
The pattern to spot: the fake "verify you're human" box
A newer trick shows a box that looks like a normal robot check, then asks you to press a few keys or paste something into your computer "to verify". Real websites never ask you to do that. If a page asks you to run or paste anything, close it.
Today's easy wins
- Turn on automatic updates for your computer, phone and browser.
- Make sure the built-in protection is on: Windows Security or the Mac's own protections.
- Keep passwords in a password manager, not saved in the browser.
- Log out of your website, hosting and domain accounts when you're done. No live session, nothing to steal.
- Don't run the business site from the family or kids' laptop.