A database breach identifies a service that lost data. A combolist packages credential pairs for automated abuse. A stealer log records data collected from an infected device. Each calls for a different investigation.
Stealer logs are routinely misclassified
External-exposure reports often place database breaches, combolists and stealer logs in the same feed. That presentation encourages the same response: identify the user, reset the password, close the ticket.
That workflow fits only part of the evidence. A stealer log records material gathered by malware from a device. The investigation must reach the endpoint, every live session and the access that followed.
The distinction matters most in financial institutions, where one browser can carry authenticated access to email, client records, payment systems, document portals and privileged SaaS tools. A single ULP row may be the portable fragment of a much richer criminal collection.
Three records with different origins
1. Database breach
A database breach begins at an online service. An attacker gains access to a company’s system and extracts customer or employee records. The resulting dataset may contain email addresses, usernames, password hashes, telephone numbers, addresses or other fields held by that service.
A breach hit establishes that an identity appeared in data taken from the named provider. It tells investigators where the data originated. Device state, credential reuse and present credential validity remain separate questions.
Response starts with the affected service: identify the exposed fields, rotate any reused credentials, assess the provider’s disclosure and review related account activity.
2. Combolist
A combolist is a collection of username-and-password pairs assembled for testing against other services. Criminals combine material from breaches, phishing, malware output and older credential collections. Provenance is often weak. Age and duplication vary. The file is designed for credential stuffing: automated attempts to find accounts where the same login still works.
In a federal credential-stuffing case, investigators found nearly 40 million username-and-password pairs and tools configured to test them against corporate websites. The attack reached about 60,000 accounts. (U.S. Department of Justice, credential-stuffing case)
A combolist hit says: criminals possess a credential pair associated with this identity. It directs the team toward password reuse, account takeover controls, rate limiting, bot detection and authentication logs.
3. Stealer log
A stealer log is output produced by information-stealing malware running on an endpoint. Depending on the malware family and configuration, the collection may include browser credentials, autofill data, browsing history, cookies, session tokens, host identifiers, cryptocurrency-wallet material and selected files.
Microsoft describes Lumma as malware-as-a-service capable of stealing browser and application data and installing additional malware. The U.S. Department of Justice says LummaC2 operators targeted browser data, autofill information, email and banking credentials, and cryptocurrency seed phrases. (Microsoft Threat Intelligence, Lumma Stealer) (U.S. Department of Justice, LummaC2 disruption)
ULP means URL, login and password. A ULP row is often the portable excerpt taken from a richer log. It identifies the service visited, the identity used and the captured credential. The wider source package may carry the device and browser context that turns a leaked password into an incident lead.
Read each ULP record in two directions. The login identifies the account owner; the URL identifies the service the malware observed. A workforce identity beside an external SaaS domain differs from a customer identity beside the institution’s portal. That distinction determines who owns the response and which device investigators must find.
A stealer-log hit establishes malware collection on a device. The record alone leaves device ownership unresolved. The infected endpoint may be a managed workstation, an employee’s personal computer, a contractor’s laptop, a family member’s device or a customer endpoint that visited the institution’s website.
One credential can travel through all three
These labels describe stages in a criminal supply chain.
A credential can be stolen during a provider breach, packaged into a combolist, tested against new services and resold. A credential can also be captured by an infostealer, stripped into a ULP pair and added to a combolist. Months later, a reseller may merge it into a much larger collection.
This is why the row count can mislead. One infected device can yield many URL-login-password records. One criminal corpus can be copied, renamed and sold repeatedly. One identity can appear across several collections.
Criminal marketplaces divide and recombine this material. One log can produce many ULP rows. The same collection can be resold under different names. One identity can appear across several extracts. An alert count therefore measures observed records. Incident count emerges after deduplication by log, host, identity, service and collection time. The Justice Department’s Genesis Market case showed criminals packaging credentials with cookies and device fingerprints, then selling searchable access by account type and location. (U.S. Department of Justice, Genesis Market)
Every record has four coordinates
- Identity: Whose account appears in the record? Establish the person, role, privilege level and employment or client relationship.
- Service: Which URL appears beside the credential? An employee email paired with an external service points toward the employee’s browsing activity. A personal email paired with the bank’s login domain may point toward a customer’s infected device.
- Device: Which endpoint generated the log? Establish ownership, management status, operating system, hostname or device fingerprint, and whether the endpoint ever accessed institutional systems.
- Time: When did collection occur? Separate malware execution time, criminal publication time, reseller appearance and monitoring-platform ingestion time. These timestamps can differ by months or years.
The identity and service fields are easy to reverse. A bank’s domain can appear because a customer visited its portal from an infected home computer. A bank employee’s email can appear beside a third-party SaaS login captured from a managed or personal device. The same text string can therefore describe customer risk, workforce risk, supplier risk or direct endpoint compromise.
Why endpoint origin matters
A breached password can be changed. An infected endpoint can capture the replacement.
Password rotation contains one exposed secret. Endpoint investigation addresses the collection mechanism. Session revocation addresses authenticated access already issued to the browser. Identity-log review establishes what happened after collection.
MFA protects the authentication event. Session cookies and access tokens represent a session that has already passed authentication. Microsoft states that a stolen token may let an attacker impersonate the user until expiry or revocation. Token protection can bind supported tokens to the intended device. (Microsoft Entra documentation, token protection)
Phishing-resistant MFA remains essential. Stealer-log response adds the controls around it: revoke sessions, force reauthentication, contain the endpoint, review identity changes and examine downstream activity.
The criminal market already prices this context. During the Genesis Market takedown, the U.S. Department of Justice described packages containing credentials, browser cookies and device fingerprints. Buyers used the combination to impersonate victims and evade anti-fraud controls. (U.S. Department of Justice, Genesis Market)
Private wealth carries concentrated identity risk
Private banks, family offices and wealth managers often concentrate extraordinary authority in a small number of people. A relationship manager, executive assistant, investment officer, trustee or external accountant may use one browser to reach email, document portals, reporting systems, banking interfaces, messaging platforms and travel services.
Criminal utility follows privileges and transaction authority. A small institution can present an efficient target.
The endpoint boundary also extends beyond the corporate fleet. Executives travel. Family members share infrastructure. Contractors use personal laptops. Advisors cross between client environments. Mandiant’s investigation into attacks on Snowflake customer instances traced access to credentials from historical infostealer infections. Several source infections sat on contractor systems used for personal activity. The stolen credentials later supported data theft, extortion and sales on criminal forums. (Google Threat Intelligence Group, UNC5537 investigation)
A corporate domain in a stealer-log feed therefore deserves immediate analysis. It also deserves precision. The hit is an evidence lead. Device provenance and access telemetry determine its relationship to the institution.
What repeated sightings mean
A new record after remediation can indicate an infected device, a renewed infection, a second endpoint, a credential recapture or criminal reprocessing of older material.
Analysts need the original collection identifiers and timestamps. Compare malware family, log identifier, machine identifier, operating system, username, hostname, IP context, first-seen time and source provenance. Repeated ULP rows alone leave several explanations open.
A clean endpoint-detection console shows that the product has no matching alert. The external hit still requires endpoint and identity investigation. Detection tools see the telemetry available to them. Personal devices, unmanaged contractors, disabled sensors, missed execution and historical infections all sit outside a simple alert query.
Five questions should govern the response
1. What exactly was captured?
Obtain the source record and available metadata. Record the URL, identity, collection time, malware family, log identifier, device attributes, cookies or tokens present, and confidence in each field. Preserve hashes and source references. Keep credential values out of broad reports and tickets.
2. Which device produced it?
Map the person to managed assets, personal devices, contractor endpoints and recent access paths. Correlate endpoint telemetry, browser history, download events, extension installs, email delivery, web filtering and identity sign-ins. Device ownership is a finding to establish through evidence.
3. Which sessions and secrets remain usable?
Revoke active sessions and refresh tokens across the identity provider, email and critical SaaS platforms. Force reauthentication. Rotate passwords after device containment. Rotate browser-accessible API keys, recovery codes and locally stored secrets where the evidence places them in scope. Microsoft’s session-revocation guidance confirms that revoking sign-in sessions invalidates refresh tokens and browser session cookies for the affected user. (Microsoft Graph documentation, session revocation)
4. What happened after collection?
Review successful and failed sign-ins, impossible or unusual travel, new devices, mailbox rules, OAuth grants, MFA changes, password resets, data downloads, privilege changes and payment-instruction activity. Extend the review from the user account to every service named in the log.
5. What proves closure?
Closure requires evidence across endpoint, identity and monitoring systems: the source endpoint is clean or rebuilt; sessions are invalidated; credentials and exposed secrets are rotated; downstream activity is investigated; controls cover similar devices; fresh monitoring shows no credible recurrence.
First-response checklist
- Preserve the stealer-log record, metadata and source provenance.
- Classify the record by identity, service, device and time.
- Isolate the suspected endpoint when corporate compromise is plausible.
- Revoke sessions and refresh tokens for affected identities.
- Force reauthentication across email, identity and critical SaaS services.
- Rotate credentials after endpoint containment.
- Inspect browser extensions, downloads, persistence, credential stores and endpoint telemetry.
- Review authentication, mailbox, OAuth, data-access and payment activity.
- Hunt for the same indicators across managed endpoints.
- Include contractor, BYOD and executive personal-device paths in the scope.
- Deduplicate repeat records before counting incidents.
- Document the evidence that supports containment and closure.
What monitoring should produce
A useful stealer-log alert needs enough context to drive an investigation. A headline count fails that test.
Each finding should include the affected identity, the website or application, collection and ingestion timestamps, malware family when known, source confidence, log identifier, device metadata, duplication status, session-artifact indicators and recommended first actions.
Institution-level reporting should separate:
- Distinct identities
- Distinct source devices or device fingerprints
- Employee, contractor, customer and unknown relationships
- Managed and unmanaged endpoint confidence
- Corporate-service URLs and external-service URLs
- Fresh collections and historical material
- Unique logs and repackaged duplicates
- Open investigations and evidence-backed closures
This structure prevents a serious device compromise from disappearing inside a large breach count. It also prevents an old duplicated record from being presented as a fresh infection.
Stealer logs belong in incident response
Microsoft identified more than 394,000 Windows devices infected by Lumma during a two-month observation window. The Department of Justice has identified at least 1.7 million instances of information theft associated with that malware. These figures describe an industrial market for device-derived access, with distribution, subscription panels, resellers and downstream buyers. (Microsoft Digital Crimes Unit, Lumma disruption) (U.S. Department of Justice, LummaC2 disruption)
Private banks and wealth institutions should place credible stealer-log hits into a malware-and-identity workflow. The team should establish the endpoint, invalidate the sessions, rotate the exposed secrets and investigate the subsequent access.
A password alert asks whether a credential has escaped.
A stealer log asks which device was compromised and what the criminal collected from it.
That question is where the real investigation begins.
Frequently asked questions
What is a stealer log?
A stealer log is a collection produced by information-stealing malware on an infected device. It may include URL-login-password records, browser cookies, session tokens, autofill data, host information, wallet material and selected files, depending on the malware.
What is the difference between a stealer log and a data breach?
A data breach begins with compromise of a service or database. A stealer log begins with malware collecting data from an endpoint. The two events create different evidence and require different response paths.
What is a combolist?
A combolist is a file of username-and-password pairs assembled from one or more sources and used for credential stuffing. Source material can include database breaches, phishing collections and credentials extracted from stealer logs.
Does a stealer log prove that a corporate laptop was infected?
A stealer log proves collection from an infected device. Ownership requires investigation. The device may belong to the institution, an employee, a contractor, a family member, a vendor or a customer.
Can MFA protect an account after session cookies are stolen?
MFA remains a core control. A valid stolen session token can represent an already authenticated session until expiry, revocation or another control blocks its use. Response should include session revocation, endpoint containment and identity-log review.
Sources
- Microsoft Threat Intelligence — Lumma Stealer capabilities
- Microsoft Digital Crimes Unit — Lumma disruption
- U.S. Department of Justice — LummaC2 disruption
- Google Threat Intelligence Group — UNC5537 and stolen infostealer credentials
- U.S. Department of Justice — Genesis Market takedown
- U.S. Department of Justice — credential-stuffing case
- Microsoft Entra — token protection and session controls
- Microsoft Graph — revoke sign-in sessions