At DarkStrata we ingest and index stealer logs at scale - the actual files criminals trade on Telegram channels and dark web marketplaces. So rather than give you another abstract explainer, let's answer the question properly: what is actually in one of these things, how did it get there, and why does a folder of text files harvested from one home laptop keep turning into a corporate breach?
First, the Vocabulary
A keylogger records keystrokes on an infected device over time. It's the term most people search for, because it's the one that made it into films. But the classic keylogger - sitting quietly for weeks, logging everything you type - is no longer how most credential theft happens.
An infostealer (or just "stealer") works differently. It's smash-and-grab malware: it runs once, raids the device in seconds, uploads the loot, and frequently deletes itself. No persistence, no ongoing surveillance, often nothing left for a scanner to find afterwards. The victim's machine was compromised for under a minute - and that was enough.
A stealer log is the package the malware uploads: one folder per victim, containing everything the stealer could grab. These logs are the commodity. They get bundled by the thousand and sold, traded, or simply given away as free samples in criminal Telegram channels.
Inside an Actual Stealer Log
Open a typical log - and we've indexed a very large number of them - and you'll find a folder named something like GB[192.0.2.14]2026-01-11 containing a remarkably consistent set of files:
information.txt- the victim's operating system, hardware, IP address, country, timezone, language, installed antivirus, and the list of running processes at the moment of infection.passwords.txt- every credential saved in the device's browsers, exported as URL / username / password triples. Chrome, Edge, Firefox, Brave - the stealer takes the lot in one pass.cookies/- full session cookie jars per browser. This is the file that should worry you most, and we'll come back to it.autofill/- names, addresses, phone numbers, and payment card details from browser autofill.wallets/- cryptocurrency wallet files and browser-extension wallet data.screenshot.jpg- a photo of the victim's desktop at the moment of infection. Frequently it shows the cracked software installer that delivered the malware.
Notice what that means. The buyer of this log doesn't just get passwords. They get the victim's whole digital identity: where they live, what they log into, what their screen looked like, and - via information.txt - enough device fingerprint detail to convincingly impersonate the victim's browser.
The Cookie Problem
The passwords.txt file is bad. The cookies/ folder is worse. A session cookie is the token your browser holds after you've logged in and passed MFA. Import a stolen cookie into a fresh browser and, for as long as that session stays valid, you are that user - no password prompt, no MFA challenge, no login alert. This is why "we have 2FA everywhere" is not the defence against infostealers that many boards believe it is.
Who Makes This Malware?
Infostealers are a service industry. The best-known families - Lumma, Vidar, StealC, and before its takedown RedLine - are rented out as malware-as-a-service for a monthly subscription, complete with admin panels, customer support, and feature changelogs. The operator writes the malware; hundreds of affiliates handle distribution and keep the logs they harvest.
Law enforcement does score wins. Microsoft and international agencies seized around 2,300 LummaC2 domains in May 2025. But Bitsight and Trend Micro have both documented what happened next: Lumma rebuilt within weeks, and Vidar 2.0 and StealC grew to fill the gap. The ecosystem treats takedowns as churn.
How People Actually Get Infected
The distribution playbook in the logs we index is depressingly consistent:
- Cracked software and game cheats - still the single biggest source. The "free" Photoshop installer is free because you're the product.
- Malvertising - poisoned search ads that outrank the legitimate download page for popular tools.
- Fake fixes - the "ClickFix" pattern: a fake CAPTCHA or error page instructs the user to paste a command into the Run dialog. It works far more often than anyone would like.
- Compromised links in YouTube descriptions and GitHub repos - piggybacking on platforms people inherently trust.
- Phishing attachments - the classic route, and per the UK government's Cyber Security Breaches Survey, still involved in the overwhelming majority of UK business breaches.
Crucially, most infections we see are on personal devices: the home PC where someone also checks their work email, the laptop shared with a teenager who downloads game mods. Your corporate endpoint protection never sees the infection, but the corporate credentials saved in that browser end up in the log all the same.
From One Log to a Corporate Breach
Independent research mapping the infostealer lifecycle puts the gap between infection and the log appearing for sale at 48 hours or less. Once it's on a marketplace, buyers filter logs by domain - literally searching for @yourcompany.co.uk - and the interesting entries get resold to initial access brokers, who package "working VPN credential + session cookie for a UK manufacturer" for ransomware crews.
That's the quiet mechanism behind headline attacks. The M&S and Co-op intrusions of 2025 began with social engineering built on knowing exactly who to impersonate and what they had access to - the kind of dossier that stealer logs, breach dumps and LinkedIn scraping assemble cheaply. The breach that makes the front page rarely starts with a zero-day. It starts with a folder of text files.
What Actually Works Against Stealers
- Know when you're in a log. You can't rotate a credential you don't know is stolen. Continuous stealer-log monitoring for your domains turns "criminals have had our VPN password for three months" into "we rotated it the day it appeared". You can check whether your organisation is already exposed in a few minutes.
- Kill sessions, don't just reset passwords. If cookies were stolen, a password reset alone leaves the stolen session alive. Revoke tokens too.
- Get passwords out of browsers. A managed password manager moves the crown jewels out of the files stealers harvest first.
- Treat personal devices as part of your attack surface - because the criminals already do. Private, no-blame remediation matters here; Lens lets affected staff see and fix their own exposure without HR reading their personal accounts.
- Shorten session lifetimes on your identity provider so a stolen cookie expires before it can be resold and replayed.
The Short Version
A keylogger records what you type; an infostealer strips a device of every saved credential, cookie and card number in seconds and is gone before anyone notices. The output - the stealer log - is a standardised criminal commodity with a resale chain behind it, and the credentials inside stay dangerous until they're found and rotated. The organisations that get hurt aren't the ones that get infected. They're the ones that never find out.