Academy
TermData

Stealer logs

The package of everything an infostealer collects from a single device: passwords, cookies, autofill entries, wallets and system information.

Flow

  1. 1Collected
  2. 2Packaged
  3. 3Sorted
  4. 4Sold or used
Related families
Lumma Stealer, RedLine Stealer, Vidar
MITRE ATT&CK
T1555.003 · Credentials from Web Browsers
Sources
5 sources
01

Overview

An infostealer collects browser databases, wallet files and system information on the device it runs on and sends them to the command and control server as a single archive. This archive is called a “log”, and one archive per device is called a “bot”. MITRE ATT&CK

A log is more than a password list: its session cookies can be enough to sign in without being asked for a password or multi-factor authentication. Its value depends on how fresh it is and which corporate accounts it contains. MITRE ATT&CK

02

How it works

  1. 1

    Collected

    The malware reads browser passwords, cookies, card and autofill entries, wallets and desktop files. MITRE ATT&CK

  2. 2

    Packaged

    The data is gathered into a single archive using the family’s own folder layout (e.g. Passwords.txt, a Cookies folder, System.txt) and sent to the server. MITRE ATT&CK

  3. 3

    Sorted

    In the panel, the attacker filters logs by country, domain or wallet presence and separates the valuable ones.

  4. 4

    Sold or used

    Logs are sold individually or in bulk on markets, shared in Telegram channels or used directly for account takeover. CISA and FBI (AA25-141B)

03

Real-world examples

Lumma logs on the markets

Lumma Stealer profile

According to a joint CISA and FBI advisory, there were more than 21,000 listings selling Lumma logs on cybercrime forums between April and June 2024, a 71.7 percent increase over the same period a year earlier. CISA and FBI (AA25-141B)

Snowflake: logs from years earlier

Mandiant found that most of the credentials used in the 2024 Snowflake attacks came from past infostealer infections, some dating back to 2020 and still valid years later. Google Cloud (Mandiant)

04

How to detect it

  • Emails and URLs belonging to the organization’s domain appearing in log archives; this shows that a device was infected even if it is outside the organization. Google Cloud (Mandiant)
  • A non-browser process reading several browser profiles in a row and then making a single large upload. MITRE ATT&CK
05

What to do

  • For an account seen in a log, revoke not only the password but all open sessions and access tokens. MITRE ATT&CK
  • Enforce multi-factor authentication and restrict access to critical systems to trusted networks; neither was in place on the affected accounts in the Snowflake incident. Google Cloud (Mandiant)
06

MITRE ATT&CK

T1555.003Credentials from Web BrowsersT1539Steal Web Session CookieT1041Exfiltration Over C2 Channel
07

Related families and terms

Families

Lumma StealerActiveRedLine StealerActiveVidarActive

Report

Infostealer Threat Report — October 2026

Terms

Log marketULP formatLog dateInfostealerSession hijacking
08

Sources

  1. 1Credentials from Web Browsers (T1555.003) · MITRE ATT&CK
  2. 2Steal Web Session Cookie (T1539) · MITRE ATT&CK
  3. 3Exfiltration Over C2 Channel (T1041) · MITRE ATT&CK
  4. 4Threat Actors Deploy LummaC2 Malware to Exfiltrate Sensitive Data from Organizations · CISA and FBI (AA25-141B), 2025-05-21
  5. 5UNC5537 targets Snowflake customer instances · Google Cloud (Mandiant), 2024
From the Essential plan

Infostealer Detection

See your firm's attack surface on one screen: how many findings, at which severity, on which domain.

View productCompare plans