Turning on two-factor authentication gives you 10 backup codes and the instruction to keep them safe. Almost nobody says where. Microsoft says not to store them on the device you sign in with, Instagram suggests a screenshot, and Google's own help page names the file the codes are saved as. Infostealer malware searches for exactly that.