Hackers, Threats & Vulnerability Management – Stealerlogs: The Doggy Door to your Organisation

Vicky Desjardins, a PhD candidate in criminology at the University of Montreal and a cyber threat intelligence analyst, explains what infostealer malware, commonly traded as stealer logs, actually contains and how much damage it enables. She defines stealer logs as malware that harvests every saved credential, cookie, autofill entry, screenshot and social account from an infected device, sold as subscriptions or lifetime packages on criminal forums for roughly one hundred to a thousand US dollars. She walks through initial access brokers who resell these credentials to ransomware groups, drawing on her own ransomware research to note that a large share of strains rely on valid stolen accounts for lateral movement, not just initial entry. Beyond financial fraud and account hijacking, she details how the same data enables MFA bypass via email-based codes, extortion and sextortion built from browsing history, and physical stalking using calendar and appointment data. She closes with practical prevention advice: use MFA and EDR everywhere, never store passwords in browsers, refuse non-essential cookies, and treat personal and corporate device use as inseparable risks.