stealerlogs.orgby Seer

Found in a stealer log? What to do, in order

The order matters. Changing passwords on a computer that is still infected hands the new ones to the same malware, so the device comes first.

First
Clean the infected device
Then, from a clean device
New passwords, starting with email
Then
Sign out of every session
Then
Two-factor, wallets and cards

  1. Find and clean the infected device

    Work out which computer saved the logins that were found. It is usually one you use every day, but it can be a work laptop, a shared family computer or one you signed in on once.

    Run a full scan with an up-to-date antivirus and remove anything it finds, along with any cracked software, cheats or unknown programs. If you aren’t sure the machine is clean, back up your documents and reinstall the operating system. Do nothing else on that device until then.

  2. Change passwords from a device you trust

    Use a phone or another computer that was not infected. Start with your email account, because it can reset everything else, then banking and payments, then work accounts, then every site in the results.

    Give each site a new, different password. A password manager makes this practical.

  3. Sign out of every session

    Stolen cookies can keep someone signed in after a password change. Use each service’s option to sign out of all devices or end other sessions, starting with Google, Microsoft, Apple, Facebook and your email provider.

  4. Turn on two-factor authentication

    Use an authenticator app or a passkey rather than text messages where you can. If you kept backup codes in a file on the infected computer, generate new ones.

  5. Move cryptocurrency and replace cards

    If a crypto wallet was on the device, assume its keys or recovery phrase were taken. Create a new wallet on a clean device and move the funds. Ask your bank to replace any card that was saved in the browser.

  6. Check what an attacker may have changed

    Look for email forwarding rules, new recovery addresses or phone numbers, connected apps and devices you don’t recognise. Remove them.

  7. Tell your employer if work logins were in it

    A work account in a stealer log is a security incident for your company too. Their security team can revoke tokens and check for misuse that you can’t see.

The full records are on Seer

This site shows how many stealer log records hold a login and a masked sample of them. Seer, which runs the check, shows every record in full: the saved logins and passwords, the cookies, the infected device and when the log was collected.

Seer also searches breach records and social accounts, so one email address shows everywhere it has leaked and every account it is linked to.

See stealer logs on Seer

  • Stealer log searchFull records from infected devices, by email, username, domain, password or IP address.
  • Breached credentialsWhich data breaches an email address or username appears in, and what leaked with it.
  • Social account searchThe accounts an email address, username or phone number is linked to across hundreds of sites.
  • Plans and pricingA free account to start, and plans for investigators and security teams.