Stealer logs open path for ransomware crews

Infostealer malware is giving ransomware operators a faster route into corporate networks by supplying stolen passwords, browser cookies and authentication tokens that can defeat conventional identity controls.

The growing trade in “stealer logs” has turned infections on individual computers into a dependable source of access for organised cybercrime groups. Criminals can search the harvested data for corporate email addresses, virtual private network credentials, cloud accounts, remote desktop services and privileged administrator sessions.

Unlike traditional password theft, stealer logs can contain active browser cookies and session tokens created after a user has completed multifactor authentication. An attacker who imports a valid token may assume the victim’s authenticated session without entering a password or responding to a fresh verification request.

This allows criminals to bypass some forms of multifactor authentication rather than technically breaking them. The system sees an existing session and may treat the attacker as an approved user, particularly when the login is routed through a proxy near the victim’s location and presented with matching browser or device information.

DarkOwl’s analysis of underground markets shows that stealer logs have become a widely traded commodity supporting ransomware, fraud, espionage and account takeover. Logs are sold individually, bundled into subscription feeds or distributed freely through Telegram channels to advertise larger criminal services.

The malware typically reaches computers through phishing messages, malicious advertisements, fake software updates, pirated applications, cracked games and fraudulent verification prompts. Once installed, it searches browsers and applications for saved passwords, autofill records, cryptocurrency wallets, browsing histories, system details and session data.

The infection may last only long enough to steal the information. Attackers can then use the resulting log long after the malicious program has disappeared from the device, leaving security teams focused on malware removal while valid credentials and tokens remain exposed.

Ransomware affiliates benefit from a specialised criminal supply chain. Infostealer operators infect devices and collect data. Initial-access brokers identify valuable corporate accounts and sell them. Ransomware groups or affiliates purchase the access, move through the network, steal sensitive files and deploy encryption tools.

This division of labour lowers the technical barrier for attacks. A ransomware operator no longer needs to develop an exploit or conduct a lengthy phishing campaign when working credentials for remote access, cloud storage or software services are available through underground marketplaces.

The volume of infostealer activity has expanded sharply. Phishing emails carrying information-stealing malware increased by 84 per cent during 2024, while early 2025 data showed activity running 180 per cent above 2023 levels. Credentials offered on dark-web markets also rose by 12 per cent over the comparable period.

Credential abuse accounted for 22 per cent of the initial access methods identified across more than 12,000 confirmed breaches examined in a major industry dataset. Ransomware remained especially damaging for smaller organisations, where limited security staff, weak network segmentation and inadequate identity monitoring can allow a single compromised account to spread across the business.

The Lumma Stealer operation illustrated the scale of the ecosystem. More than 394,000 Windows computers were identified as infected between March 16 and May 16, 2025, before an international disruption seized or blocked thousands of domains used by the malware. Lumma was marketed as a service and could steal browser credentials, financial information and cryptocurrency wallet data.

Disrupting one malware family has limited long-term impact because rival products can replace it. Infostealers are relatively cheap to deploy, easy to distribute and profitable even when only a small percentage of infected devices yields access to valuable corporate systems.

The threat also extends beyond company-managed computers. Employees may use work email addresses or passwords on personal devices, save corporate credentials in unmanaged browsers or access business services from computers carrying pirated software. A home-device infection can therefore expose an employer without placing malware directly inside its network.

Security teams face an additional detection problem because stolen sessions may resemble normal activity. The attacker can use the victim’s username, browser profile, cookies and geographic region. Traditional alerts based only on failed logins or impossible travel may not trigger.

Defence now requires controls beyond standard multifactor authentication. Organisations are moving towards phishing-resistant authentication, passkeys, shorter session lifetimes, token revocation after suspected compromise and continuous checks on user behaviour, device condition and location.

Companies also need to search exposed stealer-log datasets for their domains, reset affected passwords, invalidate active sessions and examine devices linked to compromised accounts. Endpoint detection, restrictions on browser-stored credentials, network segmentation and tighter controls over privileged accounts can limit the damage after an identity is stolen.