How a laptop hack becomes a website hack
Many website hacks don't start with the website at all. They start on the laptop or phone you use to log in to it.
The biggest reason is a type of malware called an infostealer. It arrives through a fake download, a cracked program, a dodgy browser extension or a “verify you’re human” trick. In seconds it copies every password saved in your browser, plus the “stay logged in” cookies that let it skip two-step login altogether.
The numbers are large:
- 7.4 million devices were infected with infostealers in the first half of 2026, up 27% in six months.1
- 1.7 billion logins were stolen by infostealers in the same six months.1
- 52.4 billion stolen browser cookies were found in one year of research.2
How a laptop hack becomes a website hack
- Someone in the business installs a “free” program or clicks a fake update on the family computer.
- An infostealer quietly copies saved passwords and logged-in sessions, including your website, hosting and email.
- The stolen logins are sold on criminal markets, often within hours.
- A buyer logs in to your website as you. Because they use your live session, two-step login may never be asked.
It works the other way too. A hacked website can push fake “update your browser” prompts to visitors and infect their devices, which is how a problem on one small site spreads to its customers.
Device habits that protect your site
- Keep phones and computers updated, including the browser. Turn on automatic updates.
- Use the built-in protection. Windows Security and macOS’s protections are good when they’re switched on and current.
- Never install cracked or pirated software, and be careful with browser extensions.
- Never paste commands a website asks you to run to “prove you’re human”. Real sites don’t do that.
- Use a separate browser profile just for business admin, and keep passwords in a password manager, not the browser.
- Log out of admin areas when you’re done, so there’s no live session to steal.
- Don’t manage the site from shared computers, including the kids’ laptop.
- Lock your phone with a PIN or face unlock. It probably holds your email, and your email can reset every other password.
The fewer logins, the fewer sessions to steal
Every admin area you log in to is a session that can be stolen. A site with no login page at all, like a static site, removes one of the most valuable sessions on your laptop.
Sources
-
Flashpoint, Global Threat Intelligence Report, midyear 2026: infostealers. ↩ ↩2
-
NordVPN, Stolen cookies research (June 2025 to June 2026). ↩
Common questions
What is an infostealer?
A type of malware that copies every password saved in your browser, plus the "stay logged in" cookies for sites you use. It usually arrives through a fake download, a cracked program, a dodgy browser extension or a fake "verify you're human" prompt.
Can hackers get past two-step login?
Sometimes. If malware steals the session cookie from a browser where you're already logged in, the criminal can use that live session without ever being asked for a code. That's why logging out of admin areas and keeping devices clean matters.
How do I keep my business laptop safe?
Keep it updated, use the built-in protection on Windows or macOS, never install cracked software, be careful with browser extensions, keep passwords in a password manager rather than the browser, and don't run business admin from shared family computers.
Want all of this in one place?
Our free plain-English guide covers every topic in this library, with five easy wins you can do today. We'll email it to you.
Email me the free guide