Lesson 6.3

Stealer Logs & Credential Exposure

Learning Objectives

After this, students can explain what infostealer malware is and how it spreads.
After this, students can describe what a stealer log contains and why it’s more dangerous than a typical data breach.
After this, students can explain how stolen session cookies let attackers skip MFA, and what defenses help.
After this, students can distinguish combolists, credential stuffing, and initial access brokers.
After this, students can walk through the 2024 Snowflake customer breaches and the right defensive response when credentials show up in stealer logs.

1. What Is an Infostealer?

An infostealer (or “stealer”) is malware built to grab as much valuable data as possible from an infected computer — usually in seconds — and send it to the attacker. Many don’t even try to stay on the machine for long; the smash-and-grab is the point.

Sold as a service

Most infostealers are Malware-as-a-Service (MaaS): developers rent them to other criminals by subscription, complete with dashboards, updates, and customer support. Well-known families (high level only) include:

RedLine and META — disrupted by Operation Magnus in October 2024
Lumma (LummaC2) — disrupted in May 2025 when Microsoft seized about 2,300 domains and the DOJ seized its control panel
Raccoon, Vidar, StealC, RisePro

Takedowns hurt, but new families and rebuilt versions keep appearing. Platforms like Flare report collecting over a million new stealer logs every week.

How infections happen

Cracked software, game cheats, and “free” tools downloaded from sketchy sites or YouTube links
Malvertising — fake ads for popular software leading to booby-trapped installers
Phishing emails and messages with malicious attachments or links
Fake updates and fake download pages

A very common pattern: someone uses a personal or shared computer for both gaming/downloads and work logins. The stealer doesn’t care — it takes everything saved in the browser.

2. What’s in a Stealer Log?

A stealer log is the package of data taken from one infected device. It’s typically an archive (folder or zip) of text files and other artifacts.

Data	Why attackers want it
Saved browser passwords (website URL + username + password)	Direct account access; the URL shows exactly where the login is used
Cookies and session tokens	Hijack already-logged-in sessions, often skipping MFA
Autofill data (names, addresses, phone numbers, sometimes payment cards)	Identity theft, fraud, targeted phishing
Cryptocurrency wallets	Direct theft of funds
System information (IP address, OS, hardware, installed software, sometimes a screenshot)	Profiling the victim; recreating their “fingerprint” to look like them
Files from common folders (e.g., desktop documents)	Sensitive documents, saved keys
App credentials (email clients, VPN, FTP, messaging, gaming platforms)	More access
Browser fingerprints	Impersonating the victim’s device to avoid fraud checks

Why a stealer log is worse than a typical breach

Typical data breach	Stealer log
Data from one website	Data for every site saved in the victim’s browser — personal and work
Passwords are often hashed	Passwords are in plaintext
Often months or years old by the time it’s public	Often fresh — days or hours old
No session data	Includes live session cookies
Shows an email was exposed	Shows the exact login URLs — including internal VPN portals, SSO pages, admin panels, and cloud consoles

That last point matters for OSINT: stealer logs can reveal an organization’s internal login pages and SaaS apps, mapping its attack surface.

How sessions work

When you log in (password + MFA), the website gives your browser a session cookie — a token that says “this browser already logged in.” Your browser sends it with every request so you don’t have to log in again.

If an attacker steals that cookie and loads it into their own browser, the website may treat them as you — no password or MFA prompt needed, because the session is already authenticated. MITRE ATT&CK tracks this as two techniques:
- T1539 — Steal Web Session Cookie (Credential Access): taking the cookie.
- T1550.004 — Use Alternate Authentication Material: Web Session Cookie: using it to log in.

Genesis Market (taken down in 2023) built a business on this, selling victims’ cookies and browser fingerprints so buyers could impersonate them convincingly.

The browser defense arms race

Chrome App-Bound Encryption — Google added this in Chrome 127 (July 2024) specifically to make cookie theft by infostealers on Windows harder. Researchers saw infostealers bypassing it within about 45 days (by mid-September 2024), and many families (including Lumma, Vidar, StealC, and META) added bypasses.
Device Bound Session Credentials (DBSC) — binds a session to a private key stored in the device’s hardware that can’t be exported. The browser must prove it holds the key to get fresh cookies, so a stolen cookie stops working quickly once it leaves the device. DBSC reached general availability in Chrome on Windows (Chrome 146) in 2026, with macOS support announced.

Teaching point: MFA is essential, but it protects the login. Once a session exists, protecting and quickly revoking that session matters too.

Scale (vendor-reported)

SpyCloud’s 2026 Identity Exposure Report says it recaptured 8.6 billion stolen cookies and session artifacts, and 642.4 million credentials from 13.2 million infostealer infections in 2025, and that nearly half of all the identity assets it has recaptured are stolen session cookies and tokens. Treat vendor statistics as indicators of scale, not precise measurements.

4. Combolists and Credential Stuffing

Combolists

A combolist is a list of username/password pairs (often email:password) compiled from breaches, stealer logs, and other combolists. Stealer-derived lists often use a URL:login:password format that includes the website.

In January 2025, Have I Been Pwned (HIBP) added stealer logs containing 71 million email addresses, each with the password and the website it was used on — and launched a feature to show which websites the logs were collected against.
HIBP later processed a 1.5 TB corpus called “ALIEN TXTBASE”: 23 billion rows, 493 million unique website-and-email pairs, affecting 284 million unique email addresses.
SpyCloud reports that 51% of records in underground combolists it analyzed overlapped with previously seen infostealer logs — criminals repackage stealer data constantly.

Credential stuffing

Credential stuffing is automatically trying huge numbers of stolen username/password pairs against other websites. It works because people reuse passwords. One breached gaming account can unlock someone’s email, bank, or work account.

Attack	How it works
Credential stuffing	Known username/password pairs tried on many sites
Password spraying	A few common passwords tried against many usernames
Brute force	Many passwords tried against one account

Where this data is shared

Telegram channels — many post free “samples” of logs to advertise paid subscriptions (“clouds”)
Log markets — shops selling logs individually, searchable by domain
Forums — bulk sales, combolists, and tools

5. Initial Access Brokers (IABs)

Initial access brokers specialize in getting into company networks and selling that access to others — often ransomware affiliates.

Stealer logs are a prime source: a log containing a company VPN, remote desktop, or SSO login (plus a working session cookie) is a ready-made way in.
IABs advertise on forums with vague descriptions like “access to a US healthcare company, $X revenue, domain admin.”
CISA’s advisory on Medusa ransomware says the group recruits IABs in cybercriminal forums and marketplaces, offering payments between $100 and $1 million plus the chance to work exclusively for Medusa.

For defenders, an IAB listing that matches your organization’s profile is a serious warning sign. Dark web intelligence platforms monitor these listings (see 6.4-dark-web-intelligence-platforms.md).

6. Case Study: The 2024 Snowflake Customer Breaches

What happened
- In 2024, a financially motivated threat actor that Mandiant tracks as UNC5537 accessed hundreds of Snowflake customer instances (Snowflake is a cloud data platform) and stole data for extortion.
- Mandiant and Snowflake notified approximately 165 potentially exposed organizations.
- Victims included Ticketmaster (data on roughly 560 million people), AT&T (call and text metadata for about 110 million customers), Santander Bank, and Advance Auto Parts.

How it happened
- The attackers logged in with customer credentials stolen by infostealer malware on systems not owned by Snowflake. Families involved included Lumma, META, Raccoon, RedLine, RisePro, and Vidar.
- The affected accounts didn’t require MFA, and in many cases the credentials hadn’t been rotated for as long as four years.
- At least 79.7% of the accounts used had prior credential exposure — meaning the stolen credentials had been out there, and could have been caught.
- Mandiant and Snowflake both stated that no vulnerability in Snowflake’s platform was exploited.

Aftermath
- In November 2024, Connor Moucka (Canada) and John Binns (Turkey) were arrested and charged with computer fraud, wire fraud, and aggravated identity theft.
- In August 2026, Moucka pleaded guilty in federal court in Washington state; sentencing was scheduled for October 27, 2026. (Check for updates before class.)

Lessons
1. Stealer log monitoring could have flagged many of these credentials long before they were used.
2. MFA on every account — especially service and admin accounts on cloud platforms.
3. Rotate credentials and remove old ones.
4. Restrict where logins can come from (network allowlists, managed devices).
5. A “cloud breach” is often really a credential problem, not a platform flaw.

7. Defensive Response

When an employee’s credentials show up in a stealer log

Validate — When was the device infected? Which URLs and accounts are in the log? Is it a company-managed device or personal?
Reset passwords for every exposed account (work and, if appropriate, advise on personal ones).
Revoke active sessions and tokens — a password reset alone doesn’t kill a stolen session cookie.
Clean or reimage the infected device; if it’s personal, help the employee do so.
Hunt — check authentication logs for use of those credentials or sessions since the infection date.
Notify and educate the user without blame; find out how the infection happened.
Fix root causes — e.g., block cracked software, tighten policies on personal devices.

Prevention

Phishing-resistant MFA everywhere, including service and admin accounts.
Session protection — device-bound sessions (e.g., DBSC), shorter session lifetimes, conditional access that requires managed devices.
Don’t save work passwords in the browser; use a company password manager.
Separate work and personal browsers/profiles and devices.
EDR/antivirus and application allowlisting to stop stealers.
Continuous monitoring of stealer logs and leaked credentials for your domains — e.g., Flare (which can validate exposures against Microsoft Entra ID or Okta and automatically reset passwords and revoke sessions), Hudson Rock, SpyCloud, and HIBP domain search. See 6.4-dark-web-intelligence-platforms.md.

Ethics reminder

Stealer logs are full of victims’ private lives — personal accounts, documents, screenshots. Look only at what you need for the investigation, never copy plaintext passwords into notes or reports, and store findings securely (see Module 2 Legal & Ethical Boundaries).

Key Terms

Infostealer: Malware designed to quickly steal credentials, cookies, and other data from a device.
Stealer log: The package of data stolen from one infected device.
Malware-as-a-Service (MaaS): Renting malware to other criminals by subscription.
Session cookie / token: Data proving a browser has already logged in.
Pass-the-cookie / session hijacking: Using a stolen session cookie to access an account without logging in.
App-Bound Encryption: A Chrome (127+) protection making cookie theft harder on Windows.
Device Bound Session Credentials (DBSC): A browser feature that ties sessions to a hardware-protected key on the device.
Combolist: A list of username/password pairs.
ULP (URL:login:password): A common stealer-derived combolist format that includes the website.
Credential stuffing: Trying stolen username/password pairs across many sites.
Password spraying: Trying a few common passwords against many accounts.
Initial access broker (IAB): A criminal who sells access to compromised networks.

Key Takeaways

Infostealers grab saved passwords, cookies, autofill data, and crypto wallets in seconds — and are rented as a service.
A stealer log exposes every account in a browser, in plaintext, with the exact login URLs.
Stolen session cookies can bypass MFA (MITRE T1539 / T1550.004); revoke sessions, don’t just reset passwords.
Combolists fuel credential stuffing, which works because people reuse passwords.
Initial access brokers turn stealer logs into network access and sell it to ransomware groups.
Snowflake 2024: ~165 organizations exposed through stolen credentials with no MFA — no platform vulnerability needed.
Monitoring for your organization’s credentials in stealer logs (e.g., Flare) catches problems before attackers use them.

References

Free to use, copy, change and teach. Security For the Folks dedicates this course to the public domain under CC0 1.0 Universal: no permission or credit needed. Quoted material and the sources it links to belong to their own authors.