Anatomy of a stealer log entry: what one line of stolen data actually contains
When an infostealer finishes its work, the result is not a dramatic exploit. It is a text file. Sellers call it a log: everything the malware pulled off one machine, arranged so buyers can parse it at a glance. Because so much of today's account takeover starts here, it is worth seeing what a single entry contains. The entry below is an illustrative composite - no real victim's data - modeled on public research by Red Canary, SpyCloud, Hudson Rock and Sekoia, with Kaspersky's dark-web researchers rounding out the picture.
The header: a machine profile
Most stealer families begin each file with a system block. Sekoia's study of the logs trade lists the usual fields: OS version and architecture, computer and user name, CPU and GPU model, keyboard language, a hardware identifier, plus public IP, browser user-agent and a geolocation estimate. Our illustrative entry starts like this:- Machine: DESKTOP-J41R7, user "anna" - Windows 10 22H2, 64-bit
- Browser: Chrome 139 - CPU: Intel i5-10400 - GPU: GTX 1660 - keyboard: en-US
- IP: 84.xx.xx.xx (residential ISP), country field: AT - collected: 2026-11-09
The credential lines: URL, login, password
Below the header come the saved browser logins, usually as URL-login-password triples - the ULP data Hudson Rock describes. A stripped-down slice of our entry:- https://mail.example.com | a.reid91 | white-tulip-42
- https://shop.example.net | a.reid91@example.com | sunset-bike-88
- https://vpn.example-corp.com | anna.reid | Qk7!vTz9
Why the cookie jar outranks the password column
The password column gets the attention; the cookie column causes the incidents. A session cookie is the ticket a site issues after login, and a thief who replays it presents a session the server already trusts - no password guessing, no phishing page, and no multi-factor prompt, because the factor was satisfied at the original login. As SpyCloud's glossary puts it:Cookie thieves bypass authentication - even MFA.Log data can unlock corporate single sign-on, financial accounts and crypto exchanges, and Red Canary's researchers observe that adversaries take any opportunity to log in rather than hack in. Sekoia documents how far a single cookie carries: the Lapsus$ group reportedly bought an employee's cookie on the Genesis Market and worked the remote session into the company's Slack, talking IT support into a multi-factor reset. A log with a thin password column but a fresh cookie jar can be worth more than the reverse.
From operator panel to cloud of logs
Raw files start in the malware operator's panel, where each infected machine reports home. From there they are parsed and normalized - Sekoia names processing tools such as Crystal or BLTools - then filtered by keyword, deduplicated and enriched: cookies get linked to logins, account balances and follower counts checked, seed phrases validated, two-factor status recorded, with the checks routed through proxies in the victim's own country to avoid tripping fraud systems. Then the file becomes inventory. Qualified individual logs sell on centralized marketplaces for roughly five to one hundred dollars, per Sekoia's study. Volume buyers subscribe to services that call themselves clouds of logs, advertising 1,000 to 15,000 fresh logs per day at 200 to 900 dollars a month. Where that inventory flows once the panels are seized is a market question of its own - we looked at the stealer-log market after the takedowns earlier this year.How to spot a stale or fake entry
Buyers police the supply, because quality is uneven. Kaspersky's dark-web researchers note that hype around stolen databases often wraps material that is old, recycled or fabricated outright. On log markets the tells are mechanical:- Format does not match the claimed stealer family - a re-tagged or recycled file
- The same URL-login lines already circulating from earlier sales
- Cookie entries expired or failing session checks - old data sold as fresh
- System details that contradict the geolocation or the claimed corporate value
- A "fresh log" offer with no collection date at all
What a victim should rotate
If an email or domain turns up in this economy, resetting the password is the classic half-fix. SpyCloud's guidance is that a password reset alone does not remove a stolen session: as long as those cookies stay valid, the buyer keeps access. Red Canary tells responders to reset credentials and manually revoke sessions so captured cookies stop working; Hudson Rock's remediation advice pairs the same two steps. In practice that means:- Sign out of all sessions on mail, banking, SSO and social accounts
- Revoke OAuth grants and app passwords; invalidate refresh tokens
- Re-enroll multi-factor if the factor was tampered with
- Replace stored payment cards and move any wallet whose seed phrase touched the machine