A private-stealer ad dated 21 August 2026 listed six monthly panel fees, worker roles, add-ons and a refund clause. The top “Team” plan added sub-accounts for up to ten workers with three named roles: traffer, checker and worker. A refund clause promised the remaining period’s fee back if a reported issue stayed open after seven days. The product was a stealer, and it came with a small organisation chart (IS-O007).
We asked a plain question: what do sellers put in the box, and what do they charge for? We classified 694 collected posts that mention stealers, logs or clouds, and read 40 of them in full.
The answer has two parts. Sellers split the offer into distinct priced roles. Period pricing dominates the two largest roles, log clouds and licences, though not every role. Only a minority of priced offers charge for the thing itself.
These are advertisements, not verified services. Prices are asking terms in the posts, and a bare “$” means a dollar amount with no denomination stated.
Five Roles, Priced Side by Side
The 40 catalogue records fall into five roles, plus one cross-link to crypters that belongs to the exploit-trade chapter. We chose the records to contrast roles and units, so the counts below describe the catalogue and not the trade.
| Role | What the ad sells | Examples | Unit as written |
|---|---|---|---|
| Stealer licence or panel (9 records) | Use of a stealer, its panel or its builder | IS-O002, IS-O009 | Week, month, six months, year, lifetime |
| Installs and traffic (5 records) | Installs for a payload, or a search for a partner | IS-O013 | Per install, “from $0.05” (unit implied) |
| Log clouds (15 records) | Continuing access to a stream or archive of logs | IS-O016, IS-O029 | One day to lifetime |
| Logs as items (6 records) | Single logs, packs or lookups; two records are buyer requests | IS-O022, IS-O017 | Per log, per pack, per hit |
| Processing tools (4 records) | Checkers, sorters and search over logs | IS-O036, IS-O039 | Key period, requests a day, per 1,000 lines, per terabyte |
A weekly licence at $10 (IS-O002) and a log at $5 to $15 (IS-O022) are not the same kind of thing. One rents a tool, the other sells its output. Treating every “stealer” post as one market hides that difference.
Mostly Sold by the Calendar
Of the 393 offer-like posts in the candidate set, 182 carried an amount.
In 150 of them (82%) the amount bought a period or licence term. Fifteen (8%) priced an item, a volume or a quota, 13 were flat prices or bundles, one was a percentage and three were something else.
The composition matters. Of the 182 priced posts, 142 belong to the log-supply role, mostly cloud adverts, and cloud or log-feed ads are 236 of the 393 offer-like posts (60%). Those 393 offer-like posts are 56.6% of the 694 candidate posts. Period pricing is not universal by role: it covers 10 of 18 priced rental posts, 4 of 7 processing posts and 0 of 2 distribution posts.
Among the 40 catalogue records, 23 of the 34 with a price follow the same pattern. That count treats the metered line bot (IS-O038) as period-priced, because its tiers run for 1, 30 and 90 days. The catalogue over-represents the exceptions on purpose: 7 of those 34 price an item or a volume, against 8% in the wider set.
The calendar even prices the buy-out.
Five lists show both a monthly and a lifetime price (IS-O002, IS-O009, IS-O016, IS-O018, IS-O024). In them, “lifetime” costs 3.2 to 8.3 times the monthly fee.
A sixth list (IS-O006) shows $200 for “Months” and $500 for lifetime, but does not say how many months, so it is left out of that range. A stealer licence and a stream of logs follow the same logic here. Both are sold as subscriptions with a one-off option.
A period price also hides the quantity. The cloud in IS-O016 fixed its price by access period and claimed 4,000 to 6,000 logs a day. Its daily update posts counted 1,415, 1,479, 1,650 and 3,004 fresh logs on different days.
Another cloud advertised a default archive of more than 7.1 million logs and a deeper tier of more than 30 million (IS-O020). A buyer of a period cannot compute a price per log, and the seller never has to state one.
The minority that prices the thing itself shows what each unit leaves unsaid.
| Unit | Example | What the buyer can compute | What stays a claim |
|---|---|---|---|
| Access period | IS-O016 | A price per day | How many logs arrive, and how fresh they are |
| Per log | IS-O022 | $5 to $15 basic, $25 to $40 high-value, $1 each in a bundle of 1,000 | 95% validity and 48-hour replacement of dead items |
| Per pack | IS-O017 | USD 1 per 1,000 recovery phrases in the selected 500 USD / 500,000-phrase pack | Provenance and what the phrases are worth |
| Requests and lines | IS-O038 | Daily request quota, lines per request, $0.35 per 1,000 exported lines | The post disclaims any guarantee of validity or duplicates |
| Terabytes scanned | IS-O039 | $40, $90 and $120 for 5, 10 and 15 TB: $8, $9 and $8 a terabyte | Whether the price is per scan or per added database |
The link between unit and risk is not consistent. One per-log seller offers a replacement window on paper (IS-O022). Yet a period-priced panel can still offer a seven-day refund (IS-O007). And the metered service in IS-O038 is itself a 30-day subscription that meters requests, and it disclaims validity.
The Provenance Ladder, and Why Wording Proves Little
Cloud sellers sell one word, “logs”, at several levels of provenance. A comeback ad dated 22 January lists a “private” channel at $30 a week, $80 a month and $175 for three months.
Beside it sits a “leak” channel that says it republishes logs taken from other clouds, at $15, $40 and $90. The resold line costs about half at every period (IS-O019). Resale is an openly priced product line, not a secret.
Four lists that sell several lines keep the same order: the resold line sits below the private line and, where a live line is listed, live traffic sits above it. Within each post, we compared lines at one access period.
| Post | Period compared | Resold line, share of private price | Live-traffic line, multiple of private price |
|---|---|---|---|
| IS-O018, 12 January | One week | 70% ($35 against $50) | 3.6 times ($180) |
| IS-O019, 22 January | One week | 50% ($15 against $30) | Not listed |
| IS-O029, 6 May | Seven days | 93% ($65 against $70) | 2.9 times ($200) |
| IS-O034, 28 September | Thirty days | 65% ($65 against $100) | 3.5 times ($350) |
Live traffic is the premium line in every list that carries one, at 2.9 to 3.6 times the private price. The resold discount is not a rule: it ranges from 7% to 50% in these four posts. In these ads, sellers price recency as a product. Whether buyers receive different material at each tier is not observable.
The “private” label itself may be marketing. The seller in IS-O018 describes its private line as personal logs plus logs from other channels.
A February cloud advert claimed a “1:1 private cloud, no resales” at $200 a month (IS-O023). An October advert also tracked an August one closely, down to the claim of having “rebuilt the filtration system”. It charged $120 a month against $300 and moved the claimed start year from 2025 to 2023 (IS-O032, IS-O035).
Repetition runs wider than these pairs. The 393 offer-like posts hold 374 distinct normalised texts, and 41 template families cover 111 of the posts (28%). Because the candidate file was thinned to one post per repeated template, these are lower bounds.
One list was reposted on six more days in May, and its seven-day price for the resold-lines product ranged from $15 to $55 within the month (IS-O029). A single post is a snapshot. Matching text does not identify a seller, and a provenance claim does not identify a source.
Freshness Is Promised; Remedies Are Rare
Among the 236 cloud and log-feed ads, “fresh” appears in 105 (44%). The case-insensitive whole-word search for “valid”, “hit rate” or “checked” matches 20 posts (8.5%), with no manual exclusions. Refund, replacement or warranty wording appears in 12 (5%). These are keyword counts.
The last figure overstates real remedies, because a “warranty” can be marketing. IS-O021 lists a checker tool, a fresh log “every minute” and 3,000 logs a day as its warranties. It describes no replacement or refund procedure.
Concrete remedies are scarce and specific. One seller claims 95% validity “on most drops” and replaces dead items within 48 hours (IS-O022). The panel in IS-O007 offers a full refund for the remaining period if an issue stays open for seven days. At the other end, a cloud FAQ states that its logs are unchecked and carry a “no refunds” policy (IS-O028).
Trust is built another way. One cloud announces the exact log count before each drop and cites a $3,500 forum deposit, which it says is not required, as a trust signal (IS-O032). Counts, samples and deposits stand in for guarantees. They are also claims, and none was tested.
The Word “Traffer” Mostly Names Another Trade
Distribution is the obvious missing link in a stealer supply chain. The data supports only a thin account of it. A search for the word “traffer” returned 72 posts between 1 January and 27 October.
Most of those hits are not stealer recruitment. Within the 694-post candidate set, 11 posts are classed as recruitment, most of them from that same search, and only two of those concern stealers.
One is a traffic owner asking who has a stealer panel (IS-O010). The other is a project plan that lists panel, traffic, content and cash-out as separate jobs (IS-O011).
Most of the rest recruit “traffers” or media buyers for other trades. A 29 July post pays per lead through a guarantor, with no upfront payment, and accepts any traffic source (IS-O014). Counting the word would count paid-content traffic. A chat-gate bot message is the other common source of the term.
In the 694-post candidate set, only seven posts are coded as distribution work. One seller names stealer, miner and remote-control payloads as customers and prices nothing (IS-O012). Another sells installs from $0.05, marketed as suited to three named stealer families, with a claimed 1,000 or more a day (IS-O013). The unit, “per install”, is implied rather than written.
The author of the project plan states that stealer rent costs $300 a month and traffic about $3,000 to $4,000, with no period given for the traffic.
That is a cost statement by a prospective operator, not an observed price. It still points the same way as the rest of the catalogue. In these selected ads, licence terms are visible, while the work of getting installs is discussed more than it is priced. The plan gives no revenue split for participants, and the referral percentage in IS-O007 has no figure.
A Thin Buyer Side, a Metered Processing Layer
Only 12 of the 694 candidate posts are buyer requests. One buyer of “used” logs offers up to $0.06 to $0.08 per log, in lots of 100,000 to 200,000. The buyer refuses logs sold before or older than two months (IS-O026).
A separate seller advertises fresh logs as individual items (IS-O022). The buyer request and that offer do not establish a common denomination or comparable product, so their amounts are not ranked. The explicit used-log and resale wording supports a narrower reading: some selected posts advertise another use or redistribution of previously held logs. A buyer of processed cookies, by contrast, pays “for uniqueness and validity” and states no rate (IS-O033).
The processing layer is sold the way clouds are. A checker comes as keys from three days to three months, and each longer tier adds three bonus days (IS-O036). Higher cloud tiers bundle a sorter, a search tool and a checker, so sorting becomes part of the price (IS-O018). Only a wallet-recovery checker is a flat $200 purchase (IS-O037).
What a Monitoring Team Can and Cannot Read From This
For a credential-exposure or session-token decision, the catalogue supports five limits.
- A family name on a log post is a label sellers attach. Vidar appears in 80 of the 267 offer-like log-supply posts and in 2 of the 28 rental posts. Do not route a response by that name; see what a family name does in a post.
- In the sampled ads, sellers price recency as a premium line. Live-traffic lines cost 2.9 to 3.6 times the private line, so a session token seen in any feed should be treated as perishable. The decision that matters is how fast sessions are revoked, not which stealer collected them.
- The same log can be served twice. Resold lines and copied templates mean that a second sighting in a “leak” line may be the first sighting again. Count exposures by credential or session, not by post or channel.
- A cloud’s access price cannot size exposure. A period price fixes no log count: IS-O016 claimed 4,000 to 6,000 logs a day and posted counts of 1,415 to 3,004. Do not infer how many credentials or sessions are exposed from what a cloud charges.
- A price describes a seller’s ask, not the value of your data. Nothing in these ads shows whether a specific credential was in a cloud, or how long it stayed there.
A post count cannot size any of this. A notification bot sits behind most raw “stealer” posts, as explained in what 92,000 stealer posts in January really were. Dark web monitoring is most useful when it keeps the unit, the period and the claim attached to every observation. The Infostealers research edition collects the catalogue and the other investigations.
