This article was updated on July 10, 2025 with updated information
The explosive growth of infostealer malware has been a major trend in recent years. The malware is designed to stealthily infiltrate a user’s system and log personal and confidential data. Flare’s research has shown that 78% of breached companies had corporate credentials leaked in a stealer log within six months before or after the breach.
A stealer log contains stolen sensitive information, and threat actors sell them in dark web markets and prominent threat actor communities. Stealer logs are a concerning external risk on their own, but they can also contain credentials with access to the corporate IT environment, which security teams must prevent and remediate.
Flare found about 3-10% of stealer logs contain credentials to corporate SaaS applications. In fact, one user could have access to more than a dozen corporate credentials spanning SaaS applications, systems, and other critical technologies.
Organizations can protect themselves by monitoring for stealer logs on the dark web. It’s an essential part of boosting your organization’s cybersecurity posture.
Stealer Log Landscape: Brief Overview
What is infostealer malware?
Information stealer malware, or infostealer malware, is a form of Remote Access Trojan. The malware infects devices and can raid information stored in the browser such as saved passwords, form-fill data, and session cookies. The malware then exfiltrates the stolen data to a dedicated C2 infrastructure.
What are stealer logs?
Stealer logs contain the harvested sensitive information from a victim’s computer. It’s the result of infostealer malware. Stealer logs contain a wealth of personal and sensitive information. The data can include:
- Usernames and passwords.
- Financial information.
- Personal identification details.
- Active session cookies.
- The web browser’s fingerprint (including all passwords and forms saved in the browser).
- Operating system information.
- ISP information.
- Cryptocurrency wallet logins.
- Potentially confidential or sensitive files.
The “logs” in this context refer to the records of the data that the malware has captured from the infected system. Common variants include RedLine, Aurora, Raccoon, Titan, and Vidar. One stealer log contains an average of 50+ active credentials to personal and corporate websites.
What is the evolution of stealer logs?
The evolution of stealer logs mirrors the broader trends in malware development. Simple keyloggers have evolved into sophisticated software capable of bypassing advanced security measures. Modern stealer logs can target specific applications, use advanced data exfiltration methods, and even include functionalities for spreading to other systems.
Why are stealer logs especially relevant now?
Why are stealer logs concerning?
Stealer logs are often at the heart of a data breach. According to Verizon’s 2025 Data Breach Investigation Report (DBIR) 88% of web application attacks start with stolen credentials. And stealer logs are often the source of those stolen credentials.
According to the Verizon DBIR 2025, web application attacks primarily begin with stolen credentials
In Flare’s database, 46% of stealer logs from (non-managed) personal devices contained corporate credentials. This also affects ransomware, as the median time between ransomware victim disclosure and detection of related stolen credentials is 2 days. This indicates a strong correlation between stealer logs being leveraged by ransomware operators.
According to the Verizon DBIR 2025, almost half of the stealer logs in Flare’s database contained corporate credentials, and ransomware and infostealer logs are highly correlated
The risks associated with stealer logs include identity theft, financial loss, unauthorized access to private and corporate networks, data breaches, and reputational damage. If you want to prevent a data breach, implementing safeguards against stealer logs is critical to protecting your systems.
Why are stealer logs popular with cybercriminals?
There are three reasons why stealer logs are popular with bad actors:
Low barrier to entry
Infostealers are particularly dangerous since threat actors don’t need technical skills to develop infostealer malware. They can simply purchase the infostealer malware with C2 infrastructure for as low as $100 per month on the dark web. This lowers the barrier to entry for cybercriminals.
Automation to find high-value credentials
Once stolen data reaches the C2, infostealer malware panels are designed to automatically flag high-value logs. Examples include banking and financial credentials, active session cookies, and credentials for corporate SaaS applications like Okta, JumpCloud, and Auth0.
The streamlined process enables threat actors to quickly identify lucrative credentials harvested from infostealer malware.
Financial gain
Stealer logs, especially those identified with high-value credentials, are often sold to other cybercriminals for financial gain. Prominent threat actor communities and dark web forums and markets facilitate the sale of stealer logs.
Ultimately, there are three ways cybercriminals use stealer logs:
1. Exploit the stolen information for personal gain, such as using stolen credit card details.
According to Flare research, stealer logs with financial data sell for an average of $112 on Genesis Market, compared to the average of about $15 across all logs for sale. Threat actors highly value financial accounts, as they can steal directly from consumers.
2. Gain unauthorized access to other systems.
Bad actors like TRIPLESTRENGTH leverage infostealer logs as a source for stolen credentials and cookies. The group hijacks clouds for cryptocurrency mining operations and other threat activity.
3. Sell the information to other criminals.
Threat actors profit off of or build up their reputation by distributing these stealer logs. They may open a public Telegram channel with a free “sample” of a stealer log and then grant access to private channels with fresher logs for $200-$500 per month.
In another example, threat actors could sell to initial access brokers who buy hundreds of thousands of stealer logs to identify which credentials could serve as the initial access into corporate IT environments.
Initial access brokers target stealer logs with access to CRMs, RDP, VPNs, cloud hosting platforms, SaaS application access, and other corporate devices. They can exploit and expand access before reselling in dark web forums.
What are common pathways for infostealer infections?
Cracked software downloads, malicious ads, and phishing attacks are the common methods for infostealer malware distribution. Let’s take a quick look at two real-life campaigns to spread infostealers:
- Snow Microsoft 2022 Campaign: Attackers posted a video on YouTube claiming to offer free Microsoft 2022 software via a link in the video description. The software was actually a cracked version of Microsoft laced with infostealer malware.
- Midjourney Campaign: Bad actors exploited the popular AI art platform by setting up fake domains and running Google ads to these fraudulent sites. The site convinced users to disable antivirus software so they could download a new beta software. Instead, users downloaded infostealer malware.
There are many similarities between these two campaigns, primarily with social engineering methods. They leveraged well-known brands and the users’ desire for free access to persuade them to download malware unwittingly. Using platforms like YouTube and Google Ads helped establish the attackers as a trusted source.
Infostealer campaigns are carefully designed to manipulate people. Organizations can prepare for this threat with proactive monitoring, strong protections, and employee training.
Best Practices for Preventing, Detecting, and Remediating Stealer Logs
What are recommendations for mitigating risk from stealer logs?
Organizations can prevent, detect, and remediate stealer logs by implementing these measures:
- Password managers: Encourage employees to use a password manager and not save their passwords in the browser. It can eliminate a significant amount of risk.
- MFA: Multi-factor authentication adds another layer of security to corporate devices. Stealer logs can steal session cookies, but it’s possible they aren’t fresh enough to use.
- Employee training: Employees are the first layer of defense against external risks. Providing cybersecurity training, especially additional training for users who fail the initial training, will holistically improve the organization’s defenses.
- Personal device policies: Employees saving corporate credentials in their personal devices’ browsers are a major risk factor. It’s also crucial for employees not to share work devices with other people. Strict policies on how employees should use work and personal devices would greatly help with avoiding infostealer malware.
- Restricting download privileges: Limit the ability to download and install software to a select group of users. Implement application whitelisting to prevent unauthorized software, which is often a source of infostealer infections.
- Stealer log monitoring: Make sure your Continuous Threat Exposure Management plan includes monitoring for stealer logs across the clear, deep, and dark web. It will help your organization discover potential data leaks sooner.
How does Flare monitor for stealer logs?
Flare’s Threat Exposure Management (TEM) solution automatically monitors the clear & dark web to deliver prioritized actionable intelligence on external threats, including stealer logs and compromised credentials. Flare tracks an average of 500,000 unique stealer logs every week, and each log has thousands to hundreds of thousands of unique data points. Our comprehensive monitoring ensures that your organization learns about relevant threats quickly.
Flare can save your security team hours of work. Looking through illicit sources manually can be incredibly difficult, and searching for stealer logs relevant to your organization makes that search even more challenging. Flare automates the process and immediately notifies your teams of potential threats for further investigation.
To learn more about stealer logs and corporate access, read the report on Stealer Logs, Single Sign On, and the New Era of Corporate Cybercrime.
What are the key benefits of Flare?
- 24/7 monitoring: Flare continually monitors the dark web, threat actor forums, and marketplaces for stealer logs relevant to your organization. Billions of data points are monitored to find threats against your organization.
- Scan code repositories: Developers may accidentally leak credentials or API keys in source code, creating an additional risk if other developers incorporate them into their projects.
- Automate security workflows: Reduce costs by automating key activities and using AI to contextualize events. Flare can also translate threat actor communications from different languages.
- Session cookie prevention: Through API access, Flare can stop session cookie theft by maintaining a database of leaked credentials and active session cookies.
- Unmatched data collection: Flare uses billions of data points to provide your team with information about your organization’s security stance, relevant threats, and the movement of threat actors between platforms.
- Data transparency: Know where your threat intelligence is coming from since each is listed with its primary source.
Monitoring for Stealer Logs with Flare
The Flare Threat Exposure Management (TEM) solution empowers organizations to proactively detect, prioritize, and mitigate the types of exposures commonly exploited by threat actors. Our platform automatically and constantly scans the clear & dark web and prominent threat actor communities to discover unknown events, automatically prioritize risks, and deliver actionable intelligence you can use instantly to remediate risks from stealer logs and beyond.
Flare integrates into your security program in 30 minutes and often replaces several SaaS and open source tools. See stealer logs relevant to your organization by signing up for our free trial.
