Stealer Logs.

What are stealer logs?

A stealer log, also called an infostealer log, is the package of data that information-stealing malware collects from one infected device. The word “log” is common usage and is not a formal standard term, so there is no single official definition. This page uses CISA material on a stealer family to describe what such packages can hold.

What can a stealer log contain?

In a joint advisory, the FBI and CISA say the LummaC2 stealer can exfiltrate sensitive user information, including personally identifiable information, financial credentials, cryptocurrency wallets, browser extensions and multifactor authentication details, without immediate detection. The advisory also says it targets browser data. This is one example, and other families can differ.

MITRE also says adversaries may acquire credentials from web browsers by reading files specific to the target browser.

How do stealer logs reach attackers and buyers?

The advisory describes the malware contacting command-and-control servers through encrypted channels, and says the data returned from the server is in JSON format once decoded. The advisory also cites private sector statistics of more than 21,000 market listings selling logs from that stealer on multiple cybercriminal forums from April through June 2024, a 71.7 percent increase from the same period in 2023.

Stealer logs differ from a combolist. A combolist is a merged file of username and password pairs from many breaches. A log comes from one device and can hold much more than a password.

Why does it matter?

A log is taken from a real device, so it can hold many credentials at once, and the advisory says MFA details can be among the data. Passwords alone may not be the only risk. As general reasoning, a person whose device was infected may need to treat every saved login on it as exposed. See credential theft.

How are stealer logs detected?

There are two sides to stealer log detection. On the device, MITRE suggests monitoring for non-browser processes accessing browser credential stores, and the FBI and CISA recommend monitoring for suspicious behavior, creation and termination events, and unusual and unexpected processes. Outside the device, the question is whether your accounts or your customers’ accounts appear in a log offered for sale. Monitoring for exposed credentials answers that, and the playbook how to respond to infostealer log exposure covers what to do next.

How can you reduce the risk?

The FBI and CISA recommend these steps against the stealer described in the advisory.

• Use phishing-resistant multifactor authentication.
• Use application allowlisting to block unauthorized executables.
• Use segmentation to prevent access to sensitive systems.
• Keep systems up to date with regular updates and patches.
• Monitor and detect suspicious behavior, creation and termination events, and unusual and unexpected processes.

MITRE adds that organizations may consider weighing the risk of storing credentials in web browsers, and that user training on secure credential practices and regular updates to browsers and password managers are listed mitigations.

Are stealer logs the same as leaked credentials?

No. Leaked credentials is a broader term for any exposed login details. Stealer logs are one possible source, and they can hold more than credentials.

Are stealer logs the same as an infostealer?

No. An infostealer is the malware. The logs are the data it collects.

Related terms

See also infostealer, leaked credentials and session cookies.

Related pages in the Knowledge Hub

• RedLine Stealer
• Combolists, stealer logs and credential dumps explained
• How to respond to infostealer log exposure
• Leaked credential monitoring

Sources

• CISA: FBI and CISA say LummaC2 can exfiltrate PII, financial credentials, crypto wallets, browser extensions and MFA details, targets browser data, contacts C2 over encrypted channels, and cite more than 21,000 log listings from April to June 2024.
• MITRE ATT&CK: MITRE says adversaries may acquire credentials from web browsers by reading browser-specific files, and lists mitigations and detection.

Last checked against sources: 10 October 2026.