In September 2024, a former Disney employee in Florida downloaded what he thought was an AI image generation tool from GitHub. The file was bundled with infostealer malware. Within minutes, the program had exfiltrated everything it could reach. Every saved password from his Chrome profile, every browser cookie, his 1Password vault, and a Slack session token still authenticated to Disney’s corporate workspace.
The attacker used that single session to download more than 44 million internal Disney messages, surface unreleased project details, and dump the entire archive to a public leak site. Disney’s own systems were not breached. One employee’s laptop was. The U.S. Department of Justice indictment, filed in October 2024, named the malware family and confirmed the path: a free download, a stealer log, an active session, full corporate exposure.
This is the part most people miss. The headline says “Disney leak.” The reality is a stealer log.
Stealer logs explained
A stealer log is the structured output of an infostealer. That’s purpose-built malware that runs once on a victim’s machine, harvests everything credential-shaped it can find, packages it into a folder, and ships it to a command-and-control server. The malware does not need persistence. It does not need to escalate privileges. It executes, exfiltrates, and exits.
The folder it produces has a predictable shape. Browser passwords from Chrome, Edge, Firefox, and Opera, decrypted from the local credential store. Browser cookies, including the session cookies that authenticate you to Gmail, Outlook, Slack, AWS, GitHub, and your bank. Autofill data — names, addresses, card numbers. Cryptocurrency wallet files from MetaMask, Exodus, Atomic, and dozens of others. Screenshots of the desktop at the moment of execution. A system fingerprint: hostname, IP, installed software, hardware ID. Sometimes a Telegram or Discord session token. Sometimes a Steam or Epic Games login.
That folder, zipped and named after the victim’s machine, is a stealer log. One person’s entire digital life, exported.
The malware families running the show
A handful of infostealer families dominate this market. They are bought, sold, and updated like any commercial software product.
Redline Stealer has been the most prevalent since 2020. It is sold as malware-as-a-service for around $150 per month or $800 for a lifetime licence. Redline harvests credentials from over 30 browsers, FTP and email clients, VPN configs, and crypto wallets. In 2023, ESET and KrebsOnSecurity documented Redline logs containing credentials from inside Fortune 500 networks, military contractors, and government agencies. Operation Magnus, a coordinated international takedown announced in October 2024, disrupted Redline and Meta Stealer infrastructure — but successor families filled the gap within weeks.
Lumma Stealer (sometimes branded LummaC2) emerged in 2022 and now ships more logs per day than Redline did at its peak. Lumma costs $250–$1,000 per month depending on the tier. It is sold openly on Russian-language forums and operated through a Telegram bot interface. Microsoft and the FBI executed a coordinated takedown of Lumma’s infrastructure in May 2025, seizing roughly 2,300 domains (Microsoft DCU takedown, May 2025). Within a month, operators had rebuilt on new infrastructure.
Vidar has been around since 2018 and survives by being modular. Buyers configure exactly what they want extracted. Vidar logs often appear in initial-access broker listings — packaged with a description of the network the victim was logged into, ready to be sold to a ransomware crew.
Raccoon Stealer went dark briefly in 2022 after its alleged operator was arrested in the Netherlands, then returned as Raccoon v2. Meta Stealer, RisePro, StealC, Atomic Stealer (the macOS specialist), and a long tail of less-known families round out the ecosystem. None of them is hard to find. None of them is expensive.
How victims get infected
The delivery vectors are mundane and effective.
Cracked software downloads. A Google search for “Photoshop crack” or “Adobe Premiere activator” returns dozens of YouTube videos with download links in the description. The link goes to a password-protected ZIP hosted on MediaFire or MEGA. The password is required specifically because it prevents automated antivirus scanning of the archive. The ZIP contains the stealer.
Fake software updates. SocGholish and similar campaigns inject “your browser is out of date” prompts into compromised WordPress sites. The download is the stealer.
GitHub repositories impersonating real tools. AI image generators, game cheats, trading bots, NFT minters. The repository looks plausible. The README is convincing. The compiled binary is infostealer malware. Several Lumma campaigns in 2024 used this pattern.
Malicious browser extensions uploaded to the Chrome Web Store before Google removes them. The extension requests broad permissions, scrapes everything it can reach, and disappears.
Phishing attachments and ISO files delivered through compromised email accounts. The ISO contains an executable disguised as a PDF. Windows mounts the ISO automatically; the user double-clicks the “document” and the stealer runs.
No exploit chain is needed. No zero-day. The user clicks once.
Where logs end up
Once a stealer has shipped its log to the operator, the log enters a distribution market that runs in parallel to the dark web breach economy.
Russian Market is the largest dedicated marketplace for stealer logs and has been operational since 2019. Logs are listed individually with previews: domain count, country, antivirus status, last login dates for high-value accounts. A log with active sessions to a corporate Microsoft 365 tenant, a banking site, and a major SaaS platform might list for $200–$2,000. A log with only consumer accounts sells for $5–$15.
Genesis Market ran a similar model. It sold not just logs but a custom browser plugin that loaded the victim’s cookies, fingerprint, and timezone, letting buyers impersonate the victim’s exact browser environment. The FBI seized Genesis in April 2023 in Operation Cookie Monster, arresting users in 17 countries. New marketplaces, such as 2easy.shop and RussianMarket clones, filled the niche within months.
Telegram channels are the volume distribution layer. Channels with names like “CloudyLogs,” “RedLine Cloud,” “Daily Logs Free” post fresh logs in compressed archives daily. Some are free (used to advertise paid tiers); others are subscription-based at $50–$300 per month for access to several hundred thousand fresh logs. The Telegram model is faster than marketplace listings — logs are typically posted within hours of exfiltration.
Initial access brokers sit one layer up the food chain. They buy stealer logs in bulk, filter for corporate credentials and active VPN sessions, and resell qualified access to ransomware affiliates. A Conti or LockBit affiliate looking for an entry point into a manufacturing company can buy curated access for $5,000–$50,000. The original stealer log that started that chain might have cost $20.
Why password reset alone is not enough
This is the part most “what to do after a breach” articles get wrong.
When a credential pair leaks from a breach — your email and a hashed password from some forum that got dumped — changing the password closes the door. The attacker can no longer log in.
A stealer log is different. The log contains not just your password but your session cookies: the small files in your browser that prove you have already logged in. When you click “remember me” on a site, the server issues a cookie that bypasses authentication for as long as the cookie is valid. Most major sites issue session cookies that last weeks to months. Some — Google’s, for instance — can stay valid for over a year if regularly used.
A session cookie bypasses your password. It also bypasses multi-factor authentication. The MFA check happens at login. If the attacker imports the stolen cookie into their browser, the site treats them as already-logged-in. No password prompt, no MFA prompt, no email alert.
This is how the Disney leak worked. This is how the 2022 Uber breach worked, with attackers using an active session obtained through a contractor’s compromised machine. The EA Sports breach in 2021 worked the same way. A Slack session cookie purchased for $10 on Genesis Market gave attackers persistent access to EA’s internal Slack. They used it to social-engineer their way into source code repositories. We covered this dynamic in detail in our post on session hijacking.
A password reset does not invalidate existing session cookies on most platforms. You have to explicitly revoke all sessions. Google calls it “Sign out of all devices,” Microsoft calls it “Sign me out everywhere,” and many platforms bury this option two or three menus deep. Some sites do not offer it at all.
Until you revoke sessions, the attacker stays in.
The compounding damage
The damage from a stealer log is not the password leak. It is the combination.
A log with your Gmail session gives the attacker your inbox, your password reset emails, and your contacts. With your inbox they can initiate password resets on every other site you use, intercept the reset email, and pivot.
A log with your crypto wallet seed phrase — extracted from MetaMask’s local storage — gives the attacker every wallet derived from that seed, in every chain, forever. There is no reset. The funds move within minutes of the log being purchased.
A log with your saved corporate credentials and an active VPN session gives the attacker your employer’s internal network at the access level you have. If you are a developer with GitHub credentials saved, the attacker has your source code. If you are a finance team member with Workday saved, the attacker has payroll. If you are an admin with cloud credentials saved, the attacker has the cloud.
A log with your password manager’s vault file is worse still. The vault file syncs to your local machine for most managers, and it hands the attacker every credential you have ever stored, encrypted with your master password. If your master password is in the same log, because you typed it into a Chrome prompt that was scraped by the stealer, the vault is open.
This is why infostealer infections are catastrophic in a way that single-site breaches are not.
How to tell if you are in a stealer log
The honest answer: most people will not know until something visibly goes wrong. Stealer logs do not produce the kind of public dump that breach-notification services pick up. They circulate in private channels and on marketplace listings indexed by hash and machine ID, not by email address.
A handful of services index stealer logs and let you check exposure. HaveIBeenPwned added stealer log coverage in 2023, so searching your email there now flags whether it appears in any indexed log. Hudson Rock and SpyCloud run commercial stealer-log databases used by enterprise SOC teams. KnytX Vigil is built to add stealer-log detection alongside standard breach monitoring on its Pro tier ($14.99/mo). Once it’s live, if your email or password shows up in an indexed log, Vigil is designed to alert you. Each alert would carry the machine fingerprint, the malware family if known, and a remediation checklist. Vigil isn’t live yet; join the waitlist to turn it on at launch.
See what a scan finds → walks through an example report of the kind of exposure that turns up. If your own data surfaces, the urgent action is not just changing passwords. It is finding the infected machine, taking it offline, reformatting, and then revoking sessions everywhere. KnytX Shield isn’t live yet; join the waitlist to run your own scan at launch.
What to actually do
If a stealer log is suspected, the response order matters.
Identify the infected machine. Stealer logs almost always include a screenshot of the desktop and a system fingerprint. If you can see the log (services like Hudson Rock will show you the screenshot for your own exposure), the desktop tells you which device was compromised. If you cannot see the log, the infected machine is usually the one where you have the most browser-saved credentials.
Take it offline and reformat. Antivirus removal of an active infostealer is not reliable. The malware may have dropped secondary payloads, scheduled tasks, or persistence mechanisms you cannot enumerate. The only durable response is a clean operating system reinstall from known-good media.
From a different, clean device, change passwords on every account in priority order. Email first, then financial accounts, then cloud and SaaS, then everything else. Use a password manager and generate new unique passwords.
Revoke sessions everywhere. This is the step that matters most. On Google: Account → Security → “Your devices” → “Sign out.” On Microsoft: Security → “Sign me out.” On every other platform, find the equivalent option. Do this even for accounts where you have changed the password.
Rotate any seed phrases or recovery keys. If a crypto wallet was on the infected machine, move funds to a new wallet generated on a clean device. The old seed is compromised forever.
Enable hardware-key MFA where possible. A YubiKey or equivalent prevents future session theft from being immediately reusable because re-authentication requires the physical key.
Notify your employer if the infected machine had work credentials. This is uncomfortable. It is also the step that limits the damage to you personally rather than turning into the next Disney-scale incident.
Why this is getting worse
Three trends are pushing infostealer volume higher every year.
The malware-as-a-service model has lowered the operator skill floor to near zero. A buyer who cannot write code can rent Lumma, buy a phishing kit, and run a campaign. The barrier is now marketing, not engineering.
Browser-stored credentials and persistent sessions have become the default user experience. Saving passwords in the browser is convenient. It is also a single, exfiltratable file.
And the cleanup gap remains wide. Most users do not know stealer logs exist. Companies whose employees get infected often learn about it only when stolen sessions are used months later. The detection-to-response gap is where the damage accumulates.
Detection is the leading edge of containment. KnytX Vigil is built to run stealer-log monitoring on its Pro tier ($14.99/mo), bundled with breach monitoring, dark web alerts, and a remediation playbook for each detection. The point of monitoring is not anxiety. It is the early signal that lets you act before your session cookie becomes someone else’s payday. Vigil isn’t live yet; join the waitlist to be ready at launch.