RedLine Stealer
For years the most common source of stealer logs on the market. What it takes from an infected computer, how it gets there, and how to check whether your logins ended up in its logs.
- Also called
- RedLine
- Seen since
- 2020
- Runs on
- Windows
- Sold as
- Monthly or lifetime licences on forums and Telegram
What RedLine Stealer takes
- Passwords, cookies, autofill entries and cards saved in the browser
- Cryptocurrency wallet files and browser wallet extensions
- Logins saved in FTP, VPN and messaging apps
- The computer’s name, location, hardware and installed software
How it spreads
- Cracked software and game cheats, often linked from YouTube videos
- Phishing emails with attachments
- Search and social media ads for fake versions of real software
Background
RedLine was sold as malware-as-a-service: buyers rented a ready-made stealer and a panel to collect logs, so thousands of different people ran it.
In October 2024 an international operation led by the Dutch police, with the FBI, disrupted the infrastructure behind RedLine and the related META stealer, and US prosecutors charged a man they named as one of its developers. Logs stolen before then are still traded and still work wherever a password was never changed.
Checking for your logins
Search your email address, username or company domain on this site. The check covers stealer logs from every family, RedLine Stealer included, and shows how many of your logins are in them, for which sites and where the devices were.
A stealer log doesn’t record which malware made it, so a result won’t say whether it was RedLine Stealer or another stealer. The steps afterwards are the same either way: clean the device, then change passwords from a safe one.
Other infostealers
- Lumma Stealer: The stealer behind the fake “verify you are human” pages.
- Vidar: A long-running stealer, often delivered together with other malware.
- Raccoon Stealer: A low-cost stealer whose alleged operator was arrested in 2022.
- StealC: A newer stealer that borrows from Vidar, Raccoon and RedLine.
- Atomic macOS Stealer: Proof that Macs get infostealers too.
The full records are on Seer
This site shows how many stealer log records hold a login and a masked sample of them. Seer, which runs the check, shows every record in full: the saved logins and passwords, the cookies, the infected device and when the log was collected.
Seer also searches breach records and social accounts, so one email address shows everywhere it has leaked and every account it is linked to.
- Stealer log searchFull records from infected devices, by email, username, domain, password or IP address.
- Breached credentialsWhich data breaches an email address or username appears in, and what leaked with it.
- Social account searchThe accounts an email address, username or phone number is linked to across hundreds of sites.
- Plans and pricingA free account to start, and plans for investigators and security teams.