Log in Request a demo

How To Defend

How To Respond To Infostealer Log Exposure.

A stealer log alert means malware on a device may have copied saved passwords and browser cookies for your staff or customers. Cookies can let an attacker act as a signed-in user, even with MFA on. First isolate the likely infected device, then end all sessions and reset passwords from a clean device.

  • Identity
  • Raised by DarkWeb Monitoring
Alert area
Identity
Raised by
DarkWeb Monitoring
First 24 hours
7 steps
Investigation
8 checks
Who acts
SOC analyst, IT admin, Security manager and 1 more
Last updated October 9, 2026

What This Alert Means.

An infostealer is a type of malware that runs on a device and copies saved passwords, browser cookies and other data, then sends them to the attacker. Stolen files are often bundled as a stealer log and sold or shared. A log alert means a device used by your staff or customers may be infected right now.

This is more serious than a plain password leak. Cookies can let an attacker act as a signed-in user. MITRE notes that stolen session cookies can bypass some MFA controls. A password reset alone does not fix an infected machine.

First 24 Hours.

The device is the real problem. Handle it before you handle the passwords.

Do now
  1. SOC analyst Open the alert from the Brandefense dark web monitoring module and record the account, the sites listed and the dateKeep the evidence unchanged
  2. SOC analyst Work out which device was likely infected: work laptop, home PC or phoneThe answer decides who you call
  3. IT admin Isolate the work device from the network using your endpoint tool, if it is managedDo not wipe it yet, you need the evidence
  4. IT admin End all sessions and revoke tokens for every account named in the logA password change may not end sessions that already exist
  5. IT admin Reset passwords from a clean device, not the infected oneA reset typed on the infected machine is stolen again
  6. Security manager Contact the user and ask what they installed or opened recentlyAsk about cracked software and unofficial installers
  7. Legal Ask whether customer or staff data was exposed and whether anyone must be toldCheck with your legal counsel

Investigation Checklist.

Your goal is to learn what the stealer saw and what the attacker did with it.

Confirm scope
  • Which sites, apps and VPN or SSO logins appear in the log?Everything saved in the browser is at risk
  • Does the log hold session cookies or tokens, not only passwords?Cookies can allow access without MFA
  • Is the device managed by you, or is it a personal device?Personal devices need a different plan
  • Does endpoint protection show a stealer file, a new startup entry or odd network traffic?Collect hashes and file paths
  • Were there logins to the listed accounts after the log date from new devices or places?MITRE lists monitoring for impossible travel as a detection idea
  • Did the account gain new MFA devices, mailbox rules or API keys?These show the attacker settled in
  • Are saved cloud, code or admin credentials in the browser profile?Rotate them first
  • Did the same user have other devices or family members sharing a computer?Other profiles on a shared device may be exposed too

Containment And Removal.

You cannot pull a log back from criminals, so removal means cleaning the device and making the stolen data useless. Work through these paths.

  • The device: rebuild it from a clean image. Cleaning by hand is easy to get wrong.
  • Every account in the log: reset passwords, end sessions and rotate API keys and tokens, in that order of risk.
  • Browser data: clear saved passwords and cookies on the rebuilt device and restore only what you need.
  • Services that hold the account: ask the provider's support or abuse team to kill sessions on their side if you cannot.
  • Hosting or marketplace sites: if the log is posted openly, report the exact URL to the hosting provider's abuse contact or the platform's abuse form.
  • Law enforcement or national CERT: report active fraud to your national CERT. In Turkiye, USOM (usom.gov.tr) says its services, including incident reports, now continue on the Cyber Security Directorate site (siberguvenlik.gov.tr). In the US, use the FBI IC3.
WarningNever fix an infected device by changing passwords on it. The stealer may still be running and will copy the new ones.

Longer-Term Hardening.

MITRE lists several mitigations for stolen web session cookies. These fit stealer cases well.

  • Use hardware-bound MFA. MITRE suggests hardware tokens that check the login domain, plus conditional access that limits logins to enrolled devices. CISA calls FIDO the only widely available phishing-resistant MFA.
  • Shorten session life. MITRE suggests non-persistent sessions and setting browsers to delete persistent cookies regularly.
  • Audit logins. Watch sign-ins for stolen cookie use, such as impossible travel.
  • Keep browsers and password managers updated.
  • Restrict browser extensions and third-party cookies, as MITRE suggests, and block untrusted downloads.
  • Train users on fake sites and untrusted installers.
  • Do not save work passwords in browsers on unmanaged devices.

How To Measure That It Worked.

Look for measures that show the infection and the stolen access are both gone.

  • Share of stealer alerts where the device was found and rebuilt.
  • Share of accounts with sessions revoked and passwords reset after an alert.
  • Number of sign-ins from new devices after the log date, before and after containment.
  • Repeat alerts for the same user or device.
  • Count of staff accounts using hardware-bound MFA.
  • Number of managed devices with endpoint protection reporting.

Common Mistakes.

Most failures come from treating this as a simple password problem.

  • Resetting passwords and leaving the infected device in use.
  • Wiping the device before saving evidence.
  • Forgetting session cookies, so the attacker stays signed in.
  • Ignoring personal devices that sign in to work apps.
  • Rotating only the account named in the alert, not every saved login.
  • Blaming the user instead of fixing the weak point, such as missing endpoint tools.
  • Relying on SMS or app codes alone when the attacker holds a live session.

Questions.

  • What is a stealer log?

    A stealer log is a bundle of data copied by infostealer malware from one device. It usually holds saved passwords, browser cookies and other details. MITRE lists many infostealer families among the tools that take web session cookies, which attackers can use to act as a signed-in user.

  • Can stolen cookies bypass MFA?

    Yes, in some cases. MITRE says session cookies can be used to bypass some multi-factor authentication. The cookie stands for a login that already happened. That is why you must end all sessions and not only reset passwords.

  • Is a password reset enough after a stealer alert?

    No. If the device is still infected, the new password is copied as well. Isolate the device first, reset from a clean device, revoke sessions and tokens, and rebuild the infected machine from a clean image.

  • How do I find the infected device?

    Match the account, the sites in the log and the date to your device and sign-in records. Ask the user what they installed lately. Check endpoint tools for stealer files or odd traffic. Personal devices need a different plan from managed ones.

  • What stops stolen sessions being reused?

    MITRE suggests hardware tokens that check the login domain, conditional access limited to enrolled devices, deleting persistent cookies, and sign-in auditing for odd use such as impossible travel. CISA calls FIDO the only widely available phishing-resistant MFA.

Sources

  1. 1 MITRE ATT&CK T1539 Steal Web Session Cookie
  2. 2 CISA: More than a password (MFA)
  3. 3 NIST SP 800-63B Digital Identity Guidelines
  4. 4 OWASP Credential Stuffing Prevention Cheat Sheet
  5. 5 USOM National Cyber Incident Response Center

This page is general security guidance. It is not legal advice. Notification duties and takedown rights depend on your country, your contracts and the facts of the case, so ask your legal counsel before you act on them.

More Playbooks.

All Playbooks
Identity Deepfake and voice-clone fraud A deepfake alert means someone may be using an AI-made voice, photo or video of a senior person to trick staff, partners or customers. Treat the request as unverified until you confirm it with the real person on a channel you already trust. Pause any payment, access or data request tied to that person, and save the evidence before anything is deleted. Open Identity Executive impersonation An executive impersonation alert means someone has built a fake profile or account that uses a senior person's name, photo or role. Criminals use these to trick staff, partners or customers into paying or sharing data. First confirm with the executive through a known channel, then save evidence and warn finance. Open Identity Leaked credentials A leaked credentials alert means a working login for your staff or customers has appeared in a dark web dump, stealer log or combo list. Attackers feed these pairs into credential stuffing, then take over accounts. First confirm which account the pair opens, then reset the password, end all active sessions and check recent sign-ins before you do anything else. Open

Keep Exploring.

Knowledge Hub
Glossary term Stealer Logs Stealer logs are bundles of data collected from an infected device by information-stealing malware. Open Glossary term Infostealer An infostealer is a type of malware that copies saved passwords, browser cookies and other data from an infected device and sends it to the attacker. Open Article What Is Credential Stuffing? Attackers Don’t Crack Passwords, They Buy Them Credential stuffing explained: how attackers test real stolen username and password pairs across services, where the lists come from, and how to detect it. Open Article What Is Incident Response And How To Build It? Learn what incident response is, its six stages from preparation to lessons learned, the tools teams use, and how to build a plan for… Open

Browse The Library.