What is a stealer log?
The contents of one machine, taken by malware running on it.
When European authorities took down two of the largest families in 2024, the judicial agency listed exactly what they collect: saved usernames and passwords, and automatically saved form data such as addresses, email addresses, phone numbers, cryptocurrency wallets and cookies.
The format is per-site rather than per-company: a row records the address of a login page, the username somebody typed there, and the password. One file is one person's browser, which is why the logs read as a life rather than as a customer list.
Of the five keyless sources we check an address against, one returns this category specifically, in 1.9 seconds. The other four return breach records, which is a different question.
How is that different from a data breach?
A breach is a company losing your data. This is a device losing it.
That changes what the exposure covers. A breach reaches the accounts on one service; a log reaches every site the browser had saved, including the ones nobody would think to list, plus whatever sat in autofill.
It also changes the timeline. A breach is an event with a date; a log is a snapshot of whatever sat on the machine at the moment the malware read it, and the malware may have kept reading afterwards.
And it changes the fix. Rotating one password closes a breach exposure. It does not close a machine still running the malware, and it does not touch the session cookies that left alongside it.
Why does changing my password not always work?
Because a session cookie is proof of a login that has already happened.
Google describes the mechanism plainly: malware extracts session cookies from the browser and exfiltrates them, after which attackers can reach an account without ever needing the password.
The standards body working on the fix is blunter about why it is possible. A browser has no way to store that credential safely against software running with the same privileges, so the token leaves the machine and turns up elsewhere.
Whether a password change ends the session at all depends entirely on the site. OWASP requires the session ID to be renewed on a password change and separately advises invalidating other active sessions, and from outside you cannot tell which sites do either.
A breach is a company losing your data. This is a device losing it, which is a different problem with a different order of repair.
What order should you actually do things in?
Clean the machine, end the sessions, then change the passwords.
No single authority publishes that sequence, which is worth saying out loud. A university security team gets the first and last of it, telling readers to scan, to consider reinstalling, and to change passwords from a secure device, because changing them alone is not enough while the malware is still running.
The middle step follows from the section above. Sign out of all sessions everywhere — most large services put that behind a single control — before or alongside the rotation rather than after it.
The failure mode is specific and common: rotating passwords on a machine that is still infected hands the malware the new ones, and a stronger password changes nothing about that. That is the whole reason the order matters.
Does a hit prove my computer was infected?
No, and the commercial pages on this subject mostly say otherwise.
Your address can enter a log through a machine you have never touched: a shared or borrowed computer, a family machine, a work laptop, or somebody else typing your address into a form on their own infected device.
The data is also not clean. The operator who indexed the largest public collection of these logs writes that criminals prepare and sell it with zero guarantees as to accuracy, and that the owner of an address may never have actually visited the indicated website.
Which does not make a hit meaningless. It means the right conclusion is to verify the device rather than to assume either way, and that is the same action in both cases.
Why are the headline numbers always billions?
Because they count rows, and rows repeat.
A 2.7-billion-row set circulating alongside the sixteen-billion headline came out at 109 million unique addresses once somebody parsed it, and 96% of those were already indexed. A separate 23-billion-row set reduced to 284 million.
So a new record number usually means somebody rebundled files that were already circulating and counted the lines again. Treat every figure of that shape as a claim about file size rather than about people.
It matters practically rather than just rhetorically. If the collection is a re-run of files already circulating, nothing new has happened to you, and the correct response is the same hygiene you should already have done rather than a fresh emergency to be sold something about.
Where can you check for free?
Several places, and two of them are run by police forces.
The Dutch police run Check Your Hack, a lookup against datasets they seized in their own investigations. The site published for the 2024 takedown links an antivirus vendor's free scanner for the two families it targeted, which is a commercial company's free tool rather than a police one.
What no checker can tell you is coverage. A result of nothing found means nothing was found in that corpus, and the corpora differ enormously — which is the same reason breach checkers disagree with each other.
Be careful what you paste. Several of the results ranking for this subject are unbranded lookup boxes with no stated corpus and no named operator, and an address typed into one of those has gone somewhere you cannot audit.
Common questions
What is a stealer log?
The contents taken from one machine by malware: saved passwords, session cookies, autofill data and wallet files, recorded site by site. European authorities listed exactly that when they took down two of the largest families in 2024. One log is one person's browser, which is why it reads as a life rather than a customer list.
How is a stealer log different from a data breach?
A breach is a company losing your data; a stealer log is a device losing it. The breach reaches accounts on one service, the log reaches every site the browser had saved. The fix differs too: rotating a password closes a breach exposure and does nothing about a machine that is still infected.
Why do I keep getting hacked after changing my password?
Possibly because the malware took the session cookie too. A cookie is a bearer token proving a login already happened, so an attacker holding one needs no password. Whether a password change ends other sessions depends on the site: OWASP requires the current session ID to be renewed and separately advises invalidating the rest, and you cannot tell from outside which sites do.
What should I do first if I am in a stealer log?
Clean the machine, then end sessions everywhere, then change passwords, in that order. Rotating credentials on a device that is still infected hands the malware the new ones. No single authority publishes the full sequence, but a university security team states the clean-device rule and the cookie mechanism supplies the middle step.
Does being in a stealer log mean my computer has malware?
Not necessarily. Your address can reach a log through a shared, borrowed, family or work machine, or through somebody else typing it into a form on their own infected device. The people selling these files also guarantee nothing about their accuracy. The right conclusion is to check the device rather than to assume either way.
Is RedLine still a threat after the 2024 takedown?
Authorities took down servers in the Netherlands, seized two domains and made arrests; more than 1,200 servers in dozens of countries were found running the malware. That removed infrastructure without recalling the logs already taken, and other families kept operating. Takedowns remove operators; the data already exfiltrated stays in circulation, which is why the remedy is device hygiene rather than waiting.
Should I factory reset my computer?
It is the option that removes all doubt, and a security team publishing remediation steps lists it as one to consider rather than one to skip. A scan is faster and weaker, because documentation on this class of malware describes it interfering with security software. The decision turns on what the machine holds.
Why do the headline numbers keep saying billions?
Because they count rows rather than people. A 2.7-billion-row set circulating alongside the sixteen-billion headline distilled to 109 million unique addresses, 96% of them already indexed, and a separate 23-billion-row set reduced to 284 million. Read those figures as file size, not victims.
Are the free stealer-log checkers safe to use?
One is: the Dutch police run Check Your Hack against datasets they seized. The scanner linked from the 2024 takedown site belongs to an antivirus vendor rather than to a police force, though it is free. Others ranking for the same terms are unbranded boxes with no named operator and no stated corpus. An address typed into one of those has gone somewhere you cannot audit.
