What are infostealer logs, and what do they contain?

What are infostealer logs?

Infostealer logs are the data that an infostealer, a type of malware, copies from one infected device and sends to an attacker. Each log holds what that device had stored: saved passwords, session cookies, autofill data and device details. One infection produces one log, and the stealer log is the unit that criminals sell.

That makes a log different from the data in a breach. A breach exposes what one service stored about many people. A log exposes what one person's device stored about many services. For how logs compare with combolists and database dumps as formats, see our comparison of combolists, stealer logs and database dumps. This article covers what is inside a log and how it comes to exist.

How is a stealer log produced?

A stealer log is produced when infostealer malware runs on a victim's computer, collects what its configuration names, and sends the result to a server the attacker controls. CISA and the FBI describe the pattern for LummaC2 in a joint advisory from 21 May 2025. Operators deploy it through spearphishing links and attachments, through fake software installers, and by tricking users into running a command after a fake CAPTCHA prompt. Once it runs, the malware contacts its command-and-control server, which answers with a configuration that tells it what to take.

That configuration is why logs differ between families and between buyers. In CISA's analysis of LummaC2, the configuration can define a folder path, the file extensions to read, how deep to search and the maximum file size, plus separate commands for browser data and an option to take a screenshot. The same malware therefore produces richer or poorer logs depending on how its operator set it up.

The scale is large. CISA cites private-sector statistics of more than 21,000 market listings selling LummaC2 logs on cybercriminal forums from April through June 2024, a 71.7 percent increase over April through June 2023. The FBI identified at least 1.7 million instances in which LummaC2 was used to steal credentials and similar data, according to the Justice Department's May 2025 announcement of the domain seizures.

What do infostealer logs contain?

An infostealer log typically contains saved browser passwords with their site addresses, session cookies, autofill data, details about the device, and depending on the malware, screenshots, files and cryptocurrency wallets. Several primary sources describe the contents and agree on the core. The exact set depends on the malware family and its configuration.

Each row has a primary source behind it:

• Passwords. MITRE ATT&CK describes how attackers acquire credentials from web browsers: browsers "commonly save credentials such as website usernames and passwords", and extraction methods exist even though the store is encrypted. The site address sits next to each password in the browser's store, which is why a log's entries read like a ULP list (URL, login, password).
• Cookies, autofill and wallets. Eurojust's release on RedLine and META says the data stolen from infected devices "included saved usernames and passwords, and automatically saved form data, such as addresses, email addresses, phone numbers, cryptocurrency wallets, and cookies." The Justice Department's affidavit-based description of LummaC2 names "browser data, autofill information, login credentials for accessing email and banking services, as well as cryptocurrency seed phrases."
• MFA details. CISA and the FBI say LummaC2 can exfiltrate "multifactor authentication (MFA) details", and MITRE records that Lumma gathered information from two-factor authentication extensions for multiple browsers.
• Device details and screenshots. CISA's technical analysis shows LummaC2 querying the user name and computer name, and taking a screenshot when the configuration asks for one.

A log is not a guarantee of any of these. A device with no saved cards has no card data in its log, and a stealer configured to skip screenshots will not send them.

Why do session cookies bypass MFA?

Session cookies bypass MFA because a website treats the cookie as proof that the user already signed in, including the MFA step. An attacker who copies the cookie from a stealer log can present it from another machine and be treated as that user, without the password. A session cookie is the token a website gives your browser after you sign in. MITRE ATT&CK explains the problem in its description of web session cookie theft: sites "often use session cookies as an authentication token after a user has authenticated", and an adversary who steals one can "gain access to web applications or Internet services as an authenticated user without needing credentials." MITRE adds that "session cookies can be used to bypasses some multi-factor authentication protocols", and that cookies are often valid for an extended period even when the application is not in active use. The glossary entry on session cookie theft gives the short version.

Microsoft's token theft playbook states the same point for cloud sign-ins: a token theft attack occurs when attackers "compromise and replay tokens issued to a user, even if that user has satisfied multifactor authentication." The user already passed MFA once. The stolen token carries that result with it.

So a log with cookies can be more dangerous than a log with only passwords. A leaked password may meet an MFA prompt. A valid cookie may not. Two caveats keep the picture accurate. Cookies expire or get revoked, so a log that is weeks old may hold sessions that no longer work. And sites differ in how they tie a session to a device. For the response steps (ending sessions, revoking tokens, changing passwords from a clean device), see what to do when an employee's password is in a stealer log.

How are stealer logs sold?

Stealer logs are sold through a service model: developers rent the malware and a control panel to affiliates, who infect devices, collect the logs and then sell or use them on dark web forums, marketplaces and Telegram channels. Microsoft describes Lumma as malware-as-a-service, "marketed and sold through underground forums since at least 2022", and says its developer markets tiers of service through Telegram and other Russian-language chat forums. Depending on the tier, a buyer can build their own version of the malware, add tools to conceal and distribute it, and track stolen information through an online portal. The Justice Department calls the seized domains "user panels": login pages that let credentialed users and administrators deploy LummaC2.

The people who run the stealer are therefore often not the people who developed it. Affiliates infect devices and collect logs in the panel. MITRE notes that data captured by Lumma "has been sold in criminal markets to Initial Access Brokers", the actors who sell initial access into company networks. Eurojust says the same of RedLine and META: after retrieving the data, the infostealers "sold the information to other criminals through criminal market places", and buyers used it to steal money and cryptocurrency and to carry out follow-on hacking.

From there logs travel. They are sold one by one or in bulk, posted in Telegram channels, and eventually merged into larger collections. Our articles on how stolen data is sold and on Telegram clouds describe the channels. The combolist article explains why the same credentials come back under new names.

Which stealer families do primary sources document?

Primary sources document many stealer families. Three with government or vendor documentation are LummaC2, RedLine with META, and StealC, each the subject of a law enforcement action between 2024 and 2026. This article names only families documented in sources we could check.

The takedowns hit the infrastructure that sells and runs these tools: servers, domains, panels and sales channels. They do not hit the logs already collected. The 27 million recovered data sets are a sign of how much sits on such servers, and the logs that were sold before a takedown are not recalled. Treat a takedown as a pause in one family's supply and keep rotating exposed credentials regardless.

What does an infostealer log mean for a company?

For a company, an infostealer log is evidence that one device was infected, often a device the company does not manage, and that every account saved on it is exposed. It also holds an employee's private accounts next to their work accounts, and each saved password for a corporate site is a ready-made login. Executives are an obvious interest: their sessions reach more, and their personal details help CEO fraud and business email compromise look convincing (see which exposed data fields make CEO fraud convincing). If you want to know whether logs mentioning your company are circulating, EDG3 shows what has been posted about a domain you have authorized on dark web forums, marketplaces, Telegram and other channels, and in leak databases, with the source of each finding. If you want to know which of your executives' email addresses appear in breach and leak data, CEM finds the executives from a company name and checks their current and past email addresses against breach corpora and leak databases. For executives' personal data on people-search sites, WebThreat's specialists file opt-outs and takedown requests and verify each removal. The wider picture is in executive digital exposure.

What a log cannot tell you is equally important. It does not show whether anyone used the data, whether the passwords still work, or whether the device was reinfected. The date a log was posted is not the date of the infection. Credential leak monitoring has the same limits for any leaked-credential finding.

How WebThreat can help

EDG3 is WebThreat's threat intelligence for leaked data. It collects from the places where stealer logs are posted and sold: dark web forums and marketplaces, Telegram and other channels, and leak databases. For a domain you have authorized, it shows what has been posted about your company, where and by whom. It links reposted copies of a leak back to the first post and keeps the provenance of each. An EDG3 briefing with a threat intelligence analyst walks through what is out there for your domain, with every finding tied to its source.

CEM is a separate product. It finds your executives from a company name and checks their current and past email addresses against breach corpora and leak databases. CEM has no stealer log or session token capability, so for infostealer data EDG3 is the right tool.

A concrete next step: book an EDG3 briefing to see what has been posted about your domain, or see what CEM finds for your leadership team. The methodology explains how each works, and you can contact us with questions.

This article reflects the sources linked above as of 29 October 2026. Vendor and agency pages change; the linked pages are the authority.