> If the malware can already install a keylogger at this point, doesn't avoiding the use of stored passwords just delay the inevitable? Browsers sync passwords

> If the malware can already install a keylogger at this point, doesn't avoiding the use of stored passwords just delay the inevitable? Browsers sync passwords. all the passwords you saved to everything get exposed to the malware. Most services you use regularly these days don't require frequent logins on the same device either. For example, you may only login to your school/work at a different pc but you sync passwords on the same google account because you also check your personal email there. Now any malware at any of those devices gets your saved password and payment info. Not to mention session cookies! > I guess installing a keylogger could cause it to be detected by antivirus software? Maybe, maybe not but the av might clean it up before it gets any creds keylogged. Part of the secuity model for password managers too. > Also, in terms of mixing work and personal accounts -- it's not enough to use separate browsers, I'd have to use separate devices, correct? Yes, and avoid allowing chrome and edge to sync stuff, it's very useful for attackers lol. > What are reflective .net assembly loading & thread injection? I am sure a google search would be better than me trying to explain those in depth here. Basically you can execute code in memory without having to store the code anywhere on disk, it helps with cheaper av that focus more on disk and registry than memory and api call hooking. > Like, I'm struggling to imagine why I'd be significantly worried about a downloaded .js file on Linux/macOS. On windows by default .js is not javascript but jscript, a native script langauge similar to javascript used a lot before powershell was a thing. The windows script host (wscript.exe) will attempt to execute any .js files you double click on by default