Stealer Logs: The Remote-Work Threat You Can’t See

By Spencer McLennan · Published November 26, 2024 · Updated July 2026

An associate works from home two days a week. On the family laptop — the one the kids also use — someone clicks a fake browser-update prompt while downloading something they shouldn't. Nothing appears to happen. No slowdown, no alert, no ransom note.

In the background, a piece of malware spent about four seconds copying every password saved in that browser, every active login session, and the autofill data. Including the firm's VPN credentials and the associate's webmail login. That bundle — a stealer log — is now for sale.

Nobody breached the firm. The firm's own security tools never saw a thing, because the infected device was never the firm's to monitor.

What a stealer log actually is

Infostealer malware does one job: it silently harvests everything useful from an infected device — saved browser passwords, session cookies, autofill, sometimes crypto wallets and local files — and ships it to the operator, often within seconds, then frequently deletes itself.¹ The structured output file it produces is the stealer log: usernames, plaintext passwords, the exact login URLs they unlock, and often live session cookies.¹

This has become the dominant way credentials move. Infostealers were responsible for roughly 2.1 billion of the 3.2 billion credentials stolen in 2024 — about two-thirds of the total — and the tools run as tidy subscription businesses, commonly around $200 a month, sold with dashboards and support like any other SaaS product.² The whole thing is a market, not a lone hacker.

Two features make this a different problem from the password reuse we covered in Chapter 2 — go back to that one first if you skipped it, because this builds on it.

Session cookies defeat MFA. A stolen session cookie is proof of an already-authenticated session. Replay it and you're in without the password and without triggering the second factor. Malware lifted an estimated 17+ billion browser cookies in 2024, and stealers now update within a day when browsers change how cookies are protected.³ MFA is essential — and it is not, by itself, sufficient against this.

The infection doesn't have to touch the firm. This is the part that should worry a managing partner. The personal laptop, the home desktop, the phone with saved work logins — none of it is inside the firm's security perimeter, and none of it is visible to the firm's tools. One analysis found the median time from a personal-device infection to a corporate breach was about seven days, and the share of infostealer infections exposing enterprise single-sign-on credentials climbed from 6% to 16% in roughly two years.⁴

Why law firms are targeted

More than half of ransomware victims in 2024–25 had their domain credentials sitting in a stealer-log marketplace before the attack landed.⁵ Stealer logs are the on-ramp. And law firms combine three things the buyers of those logs love — highly sensitive data, real pressure to resolve incidents quietly, and (often) a remote or hybrid workforce logging in from devices the firm doesn't control.

The remote-work shift didn't create this threat, but it widened the door considerably. Every home device with a saved firm password is now part of the firm's attack surface, whether the firm accounts for it or not.

What actually fixes this

1. MFA, but the phishing-resistant kind where it counts. Hardware keys or passkeys resist the session-cookie replay that defeats ordinary one-time-code MFA. At minimum, get MFA everywhere; for the crown-jewel systems, move toward phishing-resistant methods.

2. Shorten sessions and bind them. Session timeouts and device binding shrink the value of a stolen cookie — a cookie for a session that already expired is worthless.

3. Separate work from personal devices. The single most effective control is that firm systems are reached only from managed devices, or through a controlled gateway — not from whatever laptop is handy. Where a personal device must be used, it goes through a posture check.

4. Monitor for your own credentials in the wild. Because the infection happens where you can't see it, the earliest warning is your domain showing up in stealer-log data. This is a service you can subscribe to the way you'd subscribe to a monitoring feed — and it's the only control on this list that operates on the left side of that timeline graphic.

5. Kill saved passwords in browsers. Browser-stored passwords are the infostealer's primary catch. A proper password manager with its own protections is a smaller target than Chrome's saved-password list.

6. Endpoint protection on anything that touches firm data. Including, awkwardly, the home devices — which is why controls 3 and 4 matter so much when you can't mandate the endpoint.

Your firm's remote-work / stealer-log checklist

• MFA everywhere; phishing-resistant (keys/passkeys) on the most sensitive systems
• Session timeouts and device binding enabled
• Firm systems reachable only from managed devices or a controlled gateway
• Domain monitored for stealer-log / credential exposure
• Browser-saved passwords disabled firm-wide; password manager in use
• Endpoint protection on every device that touches client data
• A written remote-access standard your people actually follow

Spencer McLennan is the founder and lead webmaster of LegalWebmasters, and has handled websites, hosting, and security for law firms and professional practices across the United States and Canada since 2007. He holds an MBA, a PCM from the American Marketing Association, and is a graduate student in intelligence studies. He writes the Law Firm Cybersecurity and Law Firm SEO & Design guides. Connect on LinkedIn.