Infostealer Logs: How Your Stolen Data Gets Sold
Infostealer malware packages your browser passwords, cookies, and crypto wallets into 'logs.' We explain the dark economy where this data is bought and sold.
By Mira Castell · Published · 11 min read
When a computer is infected with infostealer malware, the digital contents of a user's life are bundled into a package called a "log." These logs are then sold for surprisingly low prices on specialized underground marketplaces and private Telegram channels. This thriving economy provides fuel for a wide range of cybercrime, from simple bank fraud to sophisticated corporate network intrusions.
What Is an Infostealer Log?
Unlike ransomware that locks your files, or spyware that actively monitors you, infostealer malware is designed for a smash-and-grab operation. Its goal is to harvest as much valuable data as possible from a victim's machine, package it up, and send it to a server controlled by the attacker. This package is the "log."
A single log is typically a compressed archive (like a .zip file) containing a treasure trove of information scraped from the infected system. The contents can vary depending on the malware family—such as RedLine, Raccoon, Vidar, or Lumma—but they almost always include:
- Browser Cookies: This is one of the most valuable components. Active session cookies allow a criminal to log into your accounts—email, social media, e-commerce sites—without needing a password or even bypassing multi-factor authentication (MFA). The service thinks it's you, continuing a session you already authenticated.
- Saved Credentials: Every password you've saved in your web browser (Chrome, Firefox, Edge, etc.) is a primary target. The malware decrypts the browser's credential store and exports the list of usernames and passwords.
- Autofill Data: Names, addresses, phone numbers, and saved credit card details are scraped from browser autofill forms.
- Cryptocurrency Wallets: Infostealers are programmed to search for browser extension wallets (like MetaMask and Phantom) and desktop wallet files. They steal the seed phrases and private keys needed to drain the funds.
- System Information: Logs include a detailed fingerprint of the victim's machine: IP address, geolocation, operating system version, hardware specifications, and installed software list. This helps buyers filter for victims in specific countries or those using certain software.
- Specific Files: Some stealers are configured to grab files from the user's Desktop or Documents folders, looking for anything that seems valuable.
This collection of data gives a buyer a comprehensive, if temporary, snapshot of a victim's digital identity and financial access.
The Journey from Infection to Marketplace
The lifecycle of an infostealer log follows a well-established path from the initial compromise of a user's device to its eventual sale on the cybercrime underground. It's a highly automated and efficient process that allows threat actors to monetize infections at scale.
Stage 1: Infection The primary method for distributing infostealers is social engineering. Attackers trick users into running the malicious executable themselves. Common vectors include:
- Phishing and Malspam: Emails containing malicious attachments disguised as invoices, shipping notifications, or job offers. The text of the email pressures the recipient into opening the file.
- Malvertising: Malicious ads on search engines or websites that redirect users to a site hosting the malware download.
- Cracked Software and Games: One of the most common vectors. Attackers bundle infostealers with pirated versions of popular software, video games, or cheat engines distributed via torrent sites or YouTube video descriptions. Users who seek free access to paid products willingly disable their antivirus software and run the malware.
Understanding these tricks is the first line of defense. It's crucial to learn how to spot a phishing email or text and be deeply suspicious of unsolicited downloads.
Stage 2: Exfiltration Once executed, the infostealer runs silently in the background. It methodically collects the targeted data from browsers, applications, and system files. After gathering everything, it compresses the data into a single log file and sends it to a command-and-control (C2) server operated by the malware's owner.
Stage 3: The Marketplace Few malware operators use all the logs they collect. It's far more efficient to sell them. The logs are sorted, sometimes checked for validity with automated tools, and then put up for sale.
The Underground Economy: Logs for Sale
The stolen logs feed a robust and competitive marketplace. There are two primary venues where this data is sold: dedicated log markets and messaging app channels.
Log Marketplaces: These are sophisticated e-commerce websites built specifically for selling stolen data. Sites like the now-dismantled Genesis Market and the still-active Russian Market function like Amazon for cybercriminals. Buyers can browse listings, apply detailed filters, and purchase logs instantly. Common search filters include:
- Geolocation: Searching for logs from a specific country or even city.
- Website Access: Filtering for logs that contain active sessions or credentials for a particular website, such as `amazon.com`, `chase.com`, or `outlook.com`.
- Data Presence: Looking for logs that contain cryptocurrency wallets, FTP client credentials, or VPN access.
Prices on these markets are dynamic, determined by the quality and potential value of the data. A log from a developing nation with few valuable logins might sell for $1. A log from a high-income country with validated banking access, corporate credentials, and a crypto wallet could be priced at several hundred dollars.
Telegram Channels: Alongside dedicated markets, Telegram is a major hub for log sales. These channels are more chaotic but offer greater anonymity. Admins post new batches of logs, often in bulk, for other criminals to buy. Some channels operate on an auction model, while others offer logs in pre-packaged sets based on country or data type. The sellers, often called "loggers," might also offer a "checking" service, using automated scripts to verify that the credentials in a log are still working at the time of purchase.
Who Buys Infostealer Logs and Why?
The buyers of infostealer logs are a diverse group of criminals, each with a different motivation. The low cost and broad availability of logs make them an accessible entry point for many types of illicit activity.
| Buyer Type | Primary Goal | Common Targets in Logs |
|---|---|---|
| Financial Fraudsters | Direct monetary theft | Banking logins, credit cards, crypto wallets |
| Identity Thieves | Creating synthetic identities, account takeover | PII, social security numbers, ID documents |
| Initial Access Brokers | Selling corporate network access to other hackers | VPN credentials, RDP access, corporate email logins |
| Ransomware Groups | Network compromise and data encryption for ransom | Initial access purchased from IABs, admin credentials |
| Espionage Actors | Intelligence gathering, strategic compromise | Government, defense, and critical infrastructure access |
Low-level Cybercriminals: This is the largest group of buyers. They purchase logs to commit straightforward financial fraud. They use stolen credentials to log into banking portals and drain accounts, make fraudulent purchases with saved credit cards, or empty cryptocurrency wallets.
Identity Thieves: These actors use the personally identifiable information (PII) within logs to perform account takeovers or build synthetic identities for larger fraud schemes, such as applying for loans or filing fake tax returns.
Initial Access Brokers (IABs): A more sophisticated class of criminal. IABs sift through thousands of logs looking for one thing: a foothold into a corporate network. A log from an employee's personal computer might contain saved passwords or active session cookies for their company's VPN, Outlook Web Access, or single sign-on (SSO) portal. The IAB doesn't carry out the final attack; instead, they sell this verified "initial access" for thousands of dollars to the highest bidder.
Ransomware Gangs: These are the primary customers of IABs. Ransomware groups buy initial corporate access to begin the process of lateral movement, privilege escalation, and ultimately, the deployment of their encryptor. The entire devastating sequence of a corporate breach can begin with a single employee downloading a malicious file, and as we've seen, this is precisely how a ransomware attack unfolds, step by step.
State-Sponsored Actors: While these groups have their own powerful tools, they are not above using the cybercrime ecosystem for their own ends. Nation-state groups, like the China-linked actors tracked as NeedyMantis who target telecoms, may purchase or acquire logs to find initial access into strategic government or industrial networks, masking their activity among the noise of ordinary cybercrime.
How to Protect Yourself from Infostealers
Because infostealers rely on user error and unpatched systems, strong security hygiene is the most effective defense. Containing the damage is just as important as preventing infection.
- Practice Safe Browsing and Downloading. Be extremely cautious about downloading files, especially pirated software, game mods, or files from untrusted sources. Never open attachments from suspicious emails.
- Use a Password Manager. Do not save passwords in your browser. A password manager creates and stores strong, unique passwords for every account. If one service's credentials are stolen from a log, the damage is contained to that single account. If you're not using one, it's time to ask: do you need a password manager?
- Enable Multi-Factor Authentication (MFA). Enable MFA on every account that offers it. Prioritize phishing-resistant options like hardware security keys (YubiKey) or app-based authenticators (Google Authenticator, Authy) over SMS-based codes. While session hijacking can sometimes bypass MFA, it blocks the far more common threat of credential stuffing.
- Keep All Software Updated. Enable automatic updates for your operating system, web browser, and other applications. These updates contain critical security patches that close the vulnerabilities malware exploits.
- Use and Maintain Security Software. A modern, reputable antivirus or endpoint detection and response (EDR) solution is essential. It can detect and block known infostealer variants before they can execute and exfiltrate your data.
- Periodically Clear Browser Data. While it can be inconvenient to log back into sites, regularly clearing your browser's cookies and site data will invalidate any stolen session tokens, forcing a criminal to re-authenticate with a password and MFA.
