The infostealers behind stealer logs
Most circulating logs come from a few Windows stealers and one Mac family. Buyers rent the malware, so the same names appear in dumps from many countries.
A result on this site does not name a family. Search still finds logins from every family in the index.
Windows, since 2020
RedLine Stealer
For years the most common Windows stealer in circulating logs.
Windows, since 2022
Lumma Stealer
Often delivered by fake verify-you-are-human pages.
Windows, since 2018
Vidar
A long-running Windows stealer, often dropped with other malware.
Windows, since 2019
Raccoon Stealer
A cheap Windows stealer. Its alleged operator was arrested in 2022.
Windows, since 2023
StealC
A 2023 Windows stealer that copies features from older families.
macOS, since 2023
Atomic macOS Stealer
A macOS stealer. It prompts for the user password and opens the Keychain.
What to do with a hit
The steps are the same for every family. Clean the device, then change passwords from a machine that was not infected. Read the order.
Questions
- Does a result name the family?
- No. A dump usually does not record which stealer wrote it. The files still parse the same way.
- Do Macs get stealers?
- Yes. Atomic copies the macOS Keychain and browser data. Those logs sit in the same index as Windows dumps.
Search an email, username, URL, password, or IP. Open search.
More
- About
What the index searches and who it is for.
- What is a stealer log
The dump one infected machine produces.
- Found in a log
Clean the device first, then change passwords.
- Company domain
Find staff and customer addresses in the index.
- Sources and the 10,000 limit
Telegram bots, and why Elasticsearch stops at 10,000.