Infostealer malware copies the browser you are already logged into
The website was not broken into. Infostealer malware runs on a computer that is already signed in, takes what that session can see, and packs it into one file. That file is the product. A buyer is not reading your bank's database. They are reading a copy of your browser, your cookies, and whatever was sitting in the open on the disk. Whether a given email shows up in a check is a different question, and that page is the check. This one is how the copy gets made.
A breach is their database. This is your session
An old breach is a company losing its own list: emails and passwords it was storing, stolen once, then copied forever. An info stealer takes the open session instead. Infostealers never need that company's list. They need a minute on a machine where you have already typed the password, passed the second factor, and left the account open. The dark-web part is what happens to the package afterwards. The theft happened on the desk.
| A company breach | Infostealer malware | |
|---|---|---|
| What was taken | Rows from their system. Your computer can be fine. | A bundle from one computer: saved logins, session cookies, files, often a picture of the desktop. |
| What the buyer gets | A password that worked on that site, on the day of the breach. | The password, and a cookie that may still be a live login, plus whatever else was on that machine. |
| The first move | Change the reused password, from a computer you trust. | Remove the program before you type a new secret. Then end the old sessions, not only the password. |
Australia's cyber agency describes the haul in plain categories: saved logins, browser history and cookies, autofill, documents, crypto wallet files, a screenshot, and a note of what software the machine runs. None of that requires a flaw in the website. It requires the browser to be willing to show those things to a program running as you.
A stealer log is one computer, zipped
People hear "log" and picture a line in a database. In this trade a log is the folder the program made from a single machine, usually compressed. Cloudflare's notes on one common stealer describe the bundle: a passwords file, browser folders, a cookies folder, a wallets folder, a grab from Documents or the desktop, and a screenshot of the screen. The interesting part is not the brand of the program. The brands change. The folder is the same idea every time, because the valuable objects on a personal computer are in the same places.
The screenshot is there so a buyer can see what kind of machine this was without opening every file. A work wallpaper, a payroll tab, a wallet extension in the toolbar: the picture is a shop window. The same notes say the filename itself often advertises the country and which valuable programs were installed, wallets included. A log is priced as a machine, not as a single password. That is why two people with the same email breach are in the same boat, and two people with stealer logs are not. One log is a laptop that only had a forum account. The other is a laptop with a bank tab, a mail tab, and a seed phrase in a text file on the desktop.
Saved browser passwords are the obvious pile, and they are the easy one, because the browser has already decrypted them for the person sitting there. Cookies are the quiet pile. Files are the pile people forget they left in Documents: a spreadsheet of logins, a photo of a recovery phrase, a notes file. A seed that lives as a file is a file. The wallet page is where that phrase is supposed to sit instead. The screenshot and the software list are also indicators, in the OPSEC sense: ordinary traces that point at who uses the machine.
The cookie is a login you already finished
Two-factor authentication happens at the door. After you pass it, the site gives the browser a session cookie: a small token that means this browser is still you. You do not type the code again on every click. The cookie is why. Infostealer malware copies that token along with the password. Someone who puts the token in their own browser can be inside the account while your password is sitting unchanged, and sometimes after you have changed it.
A new password changes the secret. It does not, on every site, tear up sessions that were already issued. The control that does is the one buried in the account settings, usually worded as signing out other sessions, or logging out everywhere. If the site has no such control, the stolen cookie lives until that site decides it is old. Treat "I changed the password" as half the job. The other half is the sessions. The order, remove the program before you type the new secret, is the other page, because a new password typed on the infected computer is just the next line in the next archive.
This is also why a second factor you completed last week is not a shield against a stealer that ran this morning. The factor already succeeded. The malware did not guess the code. It took the proof that you entered the code. A prompt you have to approve on a phone still matters for a stranger who only has the password. It does not replay a cookie that was minted after you approved one.
It arrives as a program you agreed to run
The usual ways in, per the same Australian page, are a malicious attachment or link, a poisoned ad or search result, and cracked or pirated software. The cracked installer is the one that fits a personal computer: you wanted the program, theirs was free, and you ran it. There is no patch for agreeing. After that the program does not need a clever trick. It reads what your user account can already read, and it steals the password the browser has already decrypted.
The other pattern is a page that insists the computer is broken and that the repair is a command you paste into a system window. That page is not diagnosing anything. The command is the installer. Close the tab. A real captcha does not need the Run box. No name of a stealer family changes that test, and the families rotate often enough that memorising them is how guides go stale while the trick does not.
A VPN does not enter into it. The program is already on the machine, reading the disk as you. Hiding the machine's address from a website would not have kept the browser's cookie file off the disk. A VPN is a different job. So is a new browser, if the passwords and the files are still in the old profile and in Documents, and you copy them across.
The program can leave, and the log cannot
The awkward design is the one that takes the archive and quits, instead of staying on the machine as something you might notice. A scan the next day can be clean. The file can already be gone. A clean scan says what is on the computer now. It says nothing about accounts that were open when the program ran. A dark-web search, when it works, only says an email showed up in some corpus. It does not put the cookie back.
If you have reason to think this machine was copied, the sequence is short. Take the program off before any new password is typed on it. Then, on a machine you are willing to trust, change the mail account first, sign that account out of every other session, and do the same for the bank and for anywhere the same password was reused. Saved passwords in the browser are the pile to stop using. A manager is a smaller target while its vault stays locked, and it stops being smaller the moment you leave it unlocked on the same machine. A recovery phrase in a text file or a photo is not a smaller target at all.
What an email check will and will not show you, including stealer-log domains that stay hidden until you prove you own the inbox, stays on that page. The computer's copy, and the login that is still alive, are the part no check puts back.