What are stealer logs?
A stealer log is everything a piece of malware copied off one infected computer, packed into a folder and sold. It holds the passwords that computer’s browsers had saved for every site, and often enough to walk into those accounts without a password at all.
- Made by
- Infostealer malware, run once on a computer
- Holds
- Saved passwords, cookies, cards, wallets, device details
- Sold on
- Markets, forums and Telegram channels
- First step if found
- Clean the infected device
Infostealers, the malware that makes them
An infostealer is a small program with one job. It runs once on a computer, copies the data worth selling, sends it to whoever is running it and usually deletes itself. It doesn’t encrypt files or ask for a ransom, and most victims never notice it was there.
Most infostealers are rented rather than written by the people who use them. A developer sells subscriptions to a ready-made stealer and a web panel that collects the results, and thousands of buyers spread it. That is why there are so many families, and why logs come from every country.
How a computer gets infected
The stealer has to be run by someone on the computer, and it is usually disguised as something they wanted:
- Cracked software, key generators and game cheats, often linked from YouTube videos or Discord servers.
- Fake installers reached from a search ad that sits above the real download site.
- A page that claims the browser needs updating.
- A fake “verify you are human” page that asks the visitor to paste a command into Windows.
- Attachments in phishing emails, often posing as invoices, shipping notices or job offers.
What a stealer log contains
The exact contents depend on the stealer, but a typical log has:
- Saved passwords from every browser on the machine, with the site and the username or email address for each.
- Cookies, including the session cookies that keep a browser signed in.
- Autofill entries: names, addresses, phone numbers and anything else typed into forms.
- Saved payment cards.
- Cryptocurrency wallets, both wallet files and browser wallet extensions.
- Tokens for desktop apps such as Discord and Telegram.
- Details of the computer: the operating system, hardware, installed software, location and often a screenshot.
Where stealer logs go
Logs collected by a buyer’s panel are sold one at a time on dedicated markets, or in bulk. A lot of trading happens on Telegram, where channels post free batches to advertise paid subscriptions, often called log clouds, that deliver thousands of new logs a day.
Some logs are stripped down to lines of email address and password and sold again as combolists. Others are searched by buyers for the logins they want, such as banks, crypto exchanges, game accounts or a particular company’s systems.
Why a stealer log is worse than a data breach
A data breach exposes one company’s database: one password for one site, often hashed. A stealer log exposes one person: every login their browser held, in plain text, at the same moment.
The cookies make it worse. Loading someone’s session cookies into a browser can open their accounts as if they had just signed in, without asking for the password or the two-factor code. Changing a password doesn’t always end those sessions, which is why signing out everywhere is part of the cleanup.
How to find out if you are in one
Search your email address or username at the top of this site. The check counts saved logins that use it and shows a masked sample: the site, the login, the country of the infected device and when the record was added. A company domain shows logins at every address on it.
If you are found, clean the device first, then change passwords. Doing it the other way round hands the new passwords to the same malware.
What a record can’t tell you
A stealer log doesn’t name the malware that made it, so a result doesn’t say which stealer was involved. Nor does it date the infection: the date shown is when the log surfaced, which can be weeks or months later. A recent date doesn’t mean a recent infection.
The full records are on Seer
This site shows how many stealer log records hold a login and a masked sample of them. Seer, which runs the check, shows every record in full: the saved logins and passwords, the cookies, the infected device and when the log was collected.
Seer also searches breach records and social accounts, so one email address shows everywhere it has leaked and every account it is linked to.
- Stealer log searchFull records from infected devices, by email, username, domain, password or IP address.
- Breached credentialsWhich data breaches an email address or username appears in, and what leaked with it.
- Social account searchThe accounts an email address, username or phone number is linked to across hundreds of sites.
- Plans and pricingA free account to start, and plans for investigators and security teams.