Stealer log

How it works

When an infostealer runs, it gathers what it can from the device and bundles it as a log. Troy Hunt describes malware siphoning up credentials as they are entered into websites, which produces rows of website URLs with the email addresses and passwords entered into them. Because the malware runs on the device, a log can also include data beyond logins, such as browser cookies, as MITRE documents for several stealer families.

Telegram is one place logs are distributed. In the ALIEN TXTBASE case, Hunt describes a channel that gave away samples for free and sold subscriptions for more data.

How it shows up in executive exposure

A stealer log ties a credential to the exact site and device where it was captured. That context makes it more useful for account takeover than a bare combolist line: the attacker knows the site, and a log that also holds session cookies may allow access without the password.

Logs travel. Portions are repackaged into combolists and ULP lists, which strip the device detail. EDG3 watches the Telegram channels, dark web forums and marketplaces where stealer logs are posted and sold. WebThreat's CEM shows which executives appear in breach corpora and leak databases, so resets start with the most exposed leaders. For how logs are traded, see how stolen data is sold.

How to reduce the risk

• Reset every password and sign out every session for any account that appears in a log.
• Use multi-factor authentication, preferably hardware keys.
• Clean or rebuild an infected device before using it again. Resetting passwords from an infected machine hands the new ones to the same malware.
• Avoid pirated software and untrusted installers.

How it differs from related terms

A stealer log comes from a device. A database dump comes from a breached service. A combolist is a compiled file with context removed. A ULP list is a combolist with the URL added: URL, login and password. The infostealer is the malware that produces the log. See combolists vs stealer logs vs database dumps.