What 92,000 “Stealer” Posts in January Really Were

The stealer keyword count for January 2026 starts with one template. On 7 January the collection holds 2,570 posts built from one Telegram notification template. Each opens with the header “New fresh log”.

Below the header come a line labelled “Stealer” with a fixed value and a line “Status log: Valid”. Then come a price list for access (3 days $75, 1 week $120, 1 month $250) and a prompt to buy the archive password.

A single .zip file is attached, and its name starts with a two-letter country code (IS-F001). The dollar amounts carry no stated denomination.

That notification explains January’s headline number. The word “stealer” appears in 92,367 collected posts that month, and 90,621 of them (98.1%) contain this notification’s constant label. The stealer keyword count tracks how often one brand’s notification bot posted. It cannot be read as a count of infections, offers or market size.

One Notification, Four Jobs

A post in this feed does four things at once. The attached archive is a sample, and the post says its password is for sale. The price list advertises tiered access to the stream. The “Valid” status is an activity signal, and the last line is a funnel to a contact.

What the post exposes is as telling as what it carries. There is a brand, a price list, a contact, a link and a country code on the attachment name. There are no counts, no sites, no victims and no infection dates. In 3,429 parsed posts the “Stealer” label held one value and the status held one value: “Valid” every time.

A field that never varies cannot independently verify which stealer produced a log. That does not make the label wrong; the post simply gives no way to check it. The notification looks like data about stealers, but it works as an advert for access.

The Same Ad in Five Versions

The template changed in small, commercial ways. The sample dates below are the first and last days a version appeared in our sample, not exact switch-over dates.

Two details matter for reading the volume. The “discount” introduced in version A2 stayed in every later version, about nine weeks to the last post. It was a standing price, not a limited offer. And by April the notification carried another party’s advert, which turned each post into ad space as well.

A Posting Rate, Not a Market

Between 7 January and 25 April the label appears in 295,819 posts, which is 97.5% of the 303,314 raw “stealer” posts in January to April. Spread over 109 days, that is about 2,700 posts a day.

Monthly averages were roughly 2,740 a day in February, 2,410 in March and 2,150 in April, and weekly rates ran from 871 to 4,740 a day. The last day the labelled template appears, 25 April, had 3,267 posts. The next five days had none.

A rate like that belongs to a schedule. Collected posts from this brand appear through at least two channels, and the posting stops on one date. Identical notifications at this rate are most likely the output of a scheduled bot, or of a change in what Blackhole collected on that date.

After April, Other Bots Took Over

From May the label disappears from the data. Raw “stealer” volume falls from 54,643 in April to 661 in May, and then other automated sources set the pace.

June is a second bot at work. A forum bot posted 6,315 notifications that month, and 6,312 of them fell in the two weeks of 15 to 28 June.

These notifications look different from the first feed. Each lists counts: passwords, cookies, a date, an address that is usually “Unknown” and a wallet field that usually says “None found” (IS-F008).

In 366 sampled notifications the median was 150 passwords and 2,018 cookies. A share of 17.8% listed zero passwords, 98.4% showed no wallets and 91.5% had an unknown address. These are the bot’s own unverified counts. They carry no access terms, no site and no victim, so a notification is still not an infection.

A mirror bot then became the largest source: 26.5% of June and 79.3% of July. It copies forum thread titles into a JSON layout, so one seller’s daily cloud update, with a count in the title, can recur for months (IS-F009).

In July, 190 of 348 sampled mirror rows carried a forum bot’s own per-log title. The same log can reach the collection twice, once as the forum post and once as its mirror (IS-F010).

The first brand did not disappear either.

The public catalogue contains later unlabelled examples coded as brand continuations. That coding is not an independently re-established count of all later posts.

The public catalogue codes a 24 August example at $200 a week, $500 a month and $2,000 lifetime. Its 3 October example is coded with a $5,000 lifetime tier, beside an advert for an advertising service (IS-F006, IS-F007). These selected catalogue examples cannot show how large the business became or establish a like-for-like price trend.

Counting What Is Left

Subtracting the three known sources gives a remainder of 1,625 posts in January and between 397 and 1,190 in each later month. These are posts that contain the word “stealer” and come from none of the identified bots. They still include news, adverts and chat. They are a ceiling for organic posts, and collection coverage changed during the year, so the series is descriptive and not a trend.

Cleaning narrows it further. From May to October, between 117 and 318 retained distinct posts a month remain in this set; June and July are partly estimated because those windows were sampled.

For January to March the cleaned number cannot be recovered at all. A 500-post sample of January’s 92,367 contained one retained post. The resulting estimate of 106 has a 95% band from 19 to 3,603. That band is this chapter’s recomputation; the published dataset lists a narrower 33 to 1,038 band from the same sample with a different band method.

A neighbouring word shows the expected scale. “Infostealer” appears in 55 to 138 raw posts a month, with no dominant bot, and 8 to 46 survive cleaning. The word “stealer” alone produced a count a thousand times larger in January, because it sits inside a template that is posted thousands of times a day.

Could Each Post Be a Real Log?

It is a fair challenge. Every post carries an archive, so each might be one real log, and the count would then measure one brand’s output. That may be true, but nothing in the post lets us check it: the label never varies, the status never varies, and no archive was opened. A count of such posts is a count of claims.

The other alternative is several independent feeds. The evidence points the other way: one coded label value, a shared price list and a run of versions that change together. We treat it as one commercial template, posted through at least two channels.

What a Threshold on This Keyword Would Have Done

A threshold on raw “stealer” volume would have followed one brand’s template schedule: high for 109 days, then close to zero after 25 April. Neither state says anything about stealer malware. A dashboard that charts this keyword shows when a bot ran. Dark web monitoring should therefore report a source’s share next to every keyword total.

Three habits keep a count honest. Report the share of the top template next to the total. Count distinct texts and distinct sources, not posts. Keep notification bots in a separate series from adverts and discussion.

The offers that remain after that filter are the subject of what stealer sellers actually package. The labels that sellers attach to logs are the subject of what a family name does in a post. The Infostealers research edition brings the three together.