How Stealer Logs Turn Stolen Credentials and Session Cookies Into Cybercrime
Summary
Stealer logs bundle credentials, session cookies, tokens, and other data stolen by infostealer malware. Criminals trade them for account takeover and corporate access, while law-enforcement disruptions have only temporarily shifted the market.
Key points
- Infostealers can silently collect browser credentials, session cookies, payment and identity data, cryptocurrency information, and application tokens.
- Stolen session cookies can let attackers access accounts without a password or a new MFA challenge.
- Initial access brokers look for corporate VPN credentials, SSO tokens, and domain administrator access in logs, then resell qualifying access.
- Ransomware affiliates and fraudsters use stolen data for network access, account takeover, and financial theft.
- The article reports that 1.8 billion credentials were stolen in 2025 and that over half of ransomware victims in 2024–2025 had domain credentials in stealer logs beforehand.
- It identifies LummaC2, ACRStealer, StealC, and Vidar among active infostealer families in early 2026, and describes a growing macOS stealer market.
- Law-enforcement takedowns disrupt individual families and marketplaces, but activity often migrates; exposed credentials remain a risk until revoked and rotated.
Article Details
- Topic
- Stealer-log contents, underground markets, criminal use, and infostealer families
Malware
AcreedACRStealer, also referred to as Acreed, is one of the most significant new entrants of 2025–2026, it rapidly ascended to become one of the top four most actively distributed infostealer families by early 2026ACRStealerAs of early 2026, AhnLab ASEC’s February trend data identifies four families as dominating active distribution: LummaC2 (partially recovered), ACRStealer, StealC, and Vidar.Atomic macOS Stealer (AMOS)Atomic macOS Stealer (AMOS) dominated the macOS market through most of 2025, disappearing in October before returning in February 2026.LummaC2Following the disruption of LummaC2 in May 2025, established families moved quickly to absorb displaced activity.Mac.cMacSync (formerly Mac.C) emerged as the primary commodity macOS infostealer by year-end 2025.MacSyncMacSync (formerly Mac.C) emerged as the primary commodity macOS infostealer by year-end 2025.OdysseyPoseidon and Odyssey are also active macOS-targeting families tracked in current reporting.PoseidonPoseidon and Odyssey are also active macOS-targeting families tracked in current reporting.RhadamanthysRhadamanthys led through the summer until its own infrastructure was taken down by law enforcement in November 2025.StealCAs of early 2026, AhnLab ASEC’s February trend data identifies four families as dominating active distribution: LummaC2 (partially recovered), ACRStealer, StealC, and Vidar.Vidar 2.0By January 2026, Vidar 2.0 had emerged as the most widely used infostealer among threat actors, according to Flashpoint’s 2026 Global Threat Intelligence Report.