What should I do after a phishing attack steals browser passwords?

Contact your bank and card issuers, explain that your information may have been stolen, and keep monitoring transactions and credit activity. Once the machine is clean, a password manager can help generate unique passwords and identify reused or exposed credentials, but it won’t remove malware or secure accounts by itself.

For the computer itself, run a second opinion scan with a reputable malware scanner because one tool may miss leftover infostealer components. If you can’t be confident the Trojan is completely removed, back up only personal documents and perform a clean operating-system reinstall. Don’t use the infected machine to change passwords until it has been rebuilt and updated.

Treat every password saved in that browser as compromised. From a different, trusted device, change the passwords for your email, financial accounts, and other important services, making each one unique. Enable two-factor authentication wherever possible, starting with your primary email. Also review account security pages for unfamiliar devices, active sessions, recovery addresses, forwarding rules, and recent activity, then sign out of anything you don’t recognize.