The most common payload in fake freeware is an infostealer (like RedLine or Vidar). These tools scrape saved passwords from your browsers, including: