Did an infostealer take your logins?
Most infostealers run for a few seconds and delete themselves, so an antivirus scan afterwards finds nothing. What they took is still out there. Search your email address or username to see whether your saved logins are in a stealer log.
Signs you may have been infected
Sign-ins from countries you have never been to, password reset emails you didn’t ask for, or an account taken over even though two-factor authentication was on. That last one points to stolen session cookies.
How it usually happens
A cracked program or game cheat, a fake installer from an ad that outranked the real site, a “browser update” or a page that asked you to paste a command to prove you are human. One run is enough.
What the check can tell you
Whether logins that use your address are in the logs, for which sites, the country of the device and when each record was added. It can’t say which device it was, and it never scans your computer.
If you are found
Clean or reinstall the infected device before anything else. Then, from a device you trust, change the passwords for the sites listed, sign out of every session so stolen cookies stop working, and turn on two-factor authentication where you can.
If you are not
Good, but a log can take months to surface, and an infected device may have saved a different address. Check your other email addresses and your usual username too.
Breaches are a separate risk. Seer’s free check looks for the same address in data breaches.
The full records are on Seer
This site shows how many stealer log records hold a login and a masked sample of them. Seer, which runs the check, shows every record in full: the saved logins and passwords, the cookies, the infected device and when the log was collected.
Seer also searches breach records and social accounts, so one email address shows everywhere it has leaked and every account it is linked to.
- Stealer log searchFull records from infected devices, by email, username, domain, password or IP address.
- Breached credentialsWhich data breaches an email address or username appears in, and what leaked with it.
- Social account searchThe accounts an email address, username or phone number is linked to across hundreds of sites.
- Plans and pricingA free account to start, and plans for investigators and security teams.
Questions
How do I know if my computer has an infostealer?
Often you don’t: most stealers run once, copy what they want in seconds and delete themselves. The usual signs come later, as logins from places you have never been, password reset emails you didn’t ask for, or accounts taken over even though two-factor authentication was on.
Can an antivirus tell me if I was infected?
It can find a stealer that is still on the machine, and it is worth running a full scan. It cannot tell you about an infection that already ran and removed itself, which is why checking for your logins in stealer logs is useful.
Does this check scan my computer?
No. Nothing is installed or run on your device. The check looks for your email address, username or domain in logs that have already been taken from infected machines.
I was found but my antivirus says the computer is clean. What now?
The infection may have been on another device that saved the same logins, such as a work laptop, a shared family PC or a computer you once signed in on. Change the passwords listed from a device you trust and sign out of every session.