What are stealer logs? How infostealers leak company logins

A stealer log is everything an infostealer took from one infected computer, packed into a folder and uploaded to the criminal who runs it. Saved passwords, browser cookies, autofill data, a screenshot of the desktop and a description of the machine itself. One log is one computer, often belonging to one person who has no idea it happened.

Criminals collect these logs by the million and sell them in bulk. For a company, the risk is simple: if an employee, contractor or customer saved a login to your systems in their browser, that login is now in someone else's hands, usually alongside the cookie that keeps them signed in.

This guide covers what's inside a stealer log, how the malware gets onto machines, how the logs are traded, and why they've become the starting point for so many breaches.

What is an infostealer?

An infostealer is malware built to do one job quickly: copy credentials and session data off a computer and send them home. Unlike ransomware, it doesn't announce itself. Most infostealers run once, take what they can in seconds to minutes, upload it and remove themselves. Some stay to collect more.

The best-known families have names like RedLine, Vidar, Raccoon, StealC and Lumma. They're sold as subscriptions, often for a few hundred dollars a month, with a web panel where the buyer can browse the logs their campaigns have collected. That low price is why there are so many of them. Law enforcement takedowns have slowed individual operations, but new families and rebuilt versions keep appearing.

What's inside a stealer log

Logs differ between malware families, but most contain the same core files:

• Saved passwords. Every login the browser remembered, as a list of website, username and password. A typical log has dozens to hundreds of entries, covering personal and work accounts on the same machine.
• Cookies. The session cookies that keep you signed in. A valid session cookie can let an attacker open an account without the password or the multi-factor prompt.
• Autofill and cards. Names, addresses, phone numbers and sometimes saved payment cards.
• System details. The machine's IP address, country, operating system, hardware ID, installed software and the time of infection.
• A screenshot. What was on the screen when the malware ran.
• App data. Depending on the family, tokens and files from chat apps, VPN and FTP clients, password managers that weren't locked, and crypto wallets.

The combination is what makes a log valuable. A password on its own might be old. A password, a live session cookie, the company VPN client and the victim's IP address together give an attacker a working way in, and the details to make the sign-in look normal.

How computers get infected

Infostealers spread through ordinary-looking downloads, which is why they reach careful people too. The common routes:

• Cracked software and game cheats. Free versions of paid apps, keygens and cheat tools are one of the largest sources of infections.
• Malicious ads and fake download pages. Search ads that lead to a convincing copy of a real software site.
• Fake CAPTCHA and "fix this error" pages. The page tells the visitor to paste a command into their computer to prove they're human or fix a problem. The command installs the stealer.
• Phishing attachments. Invoices, CVs and shipping notices that run code when opened.
• Poisoned packages and extensions. Browser extensions, code libraries and plug-ins that were compromised or fake from the start.

Many of the infected machines that hold company logins aren't company machines at all. They're a personal laptop where someone checked work email, a family PC, or a contractor's device your IT team has never seen. Endpoint security on company laptops doesn't help when the infection is somewhere else.

How stealer logs are sold

Once collected, logs move through a few kinds of market:

• Log shops. Sites where buyers search logs by website or country and buy individual machines, often for a few dollars each.
• Telegram channels. Sellers post large batches of logs, sometimes for free to attract buyers to a paid subscription.
• Combolists. The usernames and passwords are pulled out of logs and repackaged into huge text files, losing the cookies and context but spreading the credentials further.

Buyers are rarely the same people who ran the malware. Initial access brokers search logs for logins to corporate systems such as VPNs, single sign-on portals, remote desktop gateways and cloud consoles. They test them, then sell working access to ransomware groups and data thieves.

Stealer logs vs data breaches

People often mix these up, and the difference matters for how you respond.

A data breach happens to a company. Someone gets into a service's database and copies its users' details, usually email addresses and hashed passwords. The data is often years old by the time it's traded, and the passwords may need cracking first.

A stealer log happens to a person's computer. The passwords are in plain text, they're usually current, and they come with session cookies and device details. They also cover every site that person used, not only the one that was breached.

That's why a stealer-log hit is usually more urgent than a breach hit. A breached password from 2019 is worth checking. A work login that was taken from a live browser last week is worth acting on today.

Why stealer logs lead to company breaches

Logins taken by infostealers are now one of the most common ways attackers get into companies, and several of the largest incidents of recent years started this way.

In 2024, attackers broke into Snowflake customer accounts at dozens of companies and stole data from many of them. Mandiant, which investigated, found the attackers used logins stolen by infostealer malware, some taken as far back as 2020, against accounts that had no multi-factor authentication. The passwords had never been changed.

The pattern repeats because stealer logs remove the hard part of an attack. There's no phishing campaign to run and no vulnerability to find. The attacker searches the logs for your domain, picks a login that still works and signs in.

Multi-factor authentication helps, but it isn't a complete answer. A stolen session cookie can skip the MFA prompt entirely, and logs often contain the backup codes, authenticator exports or recovery emails people keep on their machines.

What companies can do about it

You can't stop infostealers running on personal devices you don't manage. You can find out when logins tied to your company show up, and shut them down before someone uses them. In practice that means:

1. Monitor for your domains. Search stealer logs and breach data for your company email domains and for logins to your own websites and apps. Check again regularly, because new logs arrive every day.
2. Act on fresh hits first. Sort by when the log was taken. Recent logins to internal systems, single sign-on and VPNs come first.
3. Reset and revoke, not only reset. Changing the password doesn't end a stolen session. Sign the user out everywhere and revoke their tokens.
4. Check the device. The log tells you which machine was infected. If it's a company device, it needs cleaning or rebuilding. If it's personal, the person needs to know.
5. Cut down saved passwords. Use a company password manager and single sign-on, and stop browsers saving work passwords where policy allows.
6. Make MFA resistant to theft. Passkeys and hardware keys tie the sign-in to the device, which makes stolen passwords and session cookies much less useful.

We've written up the full response in what to do when employee credentials show up in a stealer log, and how to run the first check in how to check if your company's logins have been leaked.

Check your own domain

BreachDetect searches 44 billion stealer-log records from 37 million infected computers, along with hundreds of breached databases, and new logs are added every day. You can run a free check on your company domain to see how many logins tied to it have leaked. The details stay hidden until you're a customer.