Found in a stealer log. What to do
The device comes first. A password change on an infected computer hands the new secret to the same malware.
1. Identify the machine
The logins in the result were saved on one computer. It is often a daily-use PC. It can also be a work laptop, a shared family machine, or a device you used once.
2. Clean that machine
Run a full scan with current antivirus. Remove cracked software, cheats, and programs you do not recognize. If you cannot confirm it is clean, back up documents and reinstall the operating system. Do not change passwords on that device.
3. Change passwords from a clean device
Use a phone or another computer that was not in the results. Start with email, because it resets the rest. Then banking and payments, then work accounts, then every site in the hit list. Each site gets a new password.
4. End every session
Stolen cookies can keep a buyer signed in after a password change. Use each service's sign-out-of-all-devices or end-other-sessions control. Start with Google, Microsoft, Apple, and your email host.
5. Turn on two-factor authentication
Use an authenticator app or a passkey. Avoid SMS if the service offers something better. If backup codes lived in a file on the infected computer, generate new ones.
6. Move crypto and replace cards
If a wallet was on the device, treat its keys and recovery phrase as stolen. Create a new wallet on a clean device and move the funds. Ask the bank to replace any card saved in the browser.
7. Check forwarding and recovery
Look for new mail forwarding rules, recovery addresses, phone numbers, connected apps, and devices you do not recognize. Remove them.
8. Tell work if a work login was in the log
A work account in a stealer log is an incident for the company. Their team can revoke tokens and look for misuse you cannot see.
Company addresses
If the hit uses a work domain, tell the security team and point them at a domain search. Other staff machines may be in the same index.
Questions
- Why not change passwords first?
- The stealer is still running. A new password typed on that computer is copied and sent out like the old one.
- I only saw one site in the results. Am I done?
- No. Open the log. The same machine usually has more accounts and cookies than the one hit that matched your search.
- The password was old. Can I ignore it?
- Only if you already changed it from a clean device and ended other sessions. If you reused that password anywhere, change those sites too.
Search another email, username, or domain. Open search.
More
- About
What the index searches and who it is for.
- What is a stealer log
The dump one infected machine produces.
- Company domain
Find staff and customer addresses in the index.
- Sources and the 10,000 limit
Telegram bots, and why Elasticsearch stops at 10,000.
- Infostealer families
RedLine, Lumma, Vidar, Raccoon, StealC, Atomic.