A stealer log is a collection of data exfiltrated by infostealer malware, usually packaged for sale or reuse by other criminals. It can include saved usernames and passwords, browser cookies, autofill data, cryptocurrency wallet details, and sometimes screenshots or system information. Because the data is gathered from a victim’s browser and local profile, it often reflects real authenticated sessions, not just typed passwords.
Stealer logs matter because they can turn a single endpoint compromise into broad account access. Attackers use them to replay session cookies, log into email, cloud, or VPN accounts, and pivot into larger intrusions. Defenders look for signs of stealer activity such as unusual browser profile access, suspicious logins from new devices, leaked credential alerts, and rapid token or password revocation. Protecting against stealer logs means hardening endpoints, enforcing phishing-resistant MFA where possible, and treating browser-stored session data as sensitive authentication material.