Hackers get caught by infostealers the same way their victims lose accounts: commodity malware lands on their own computer and copies everything the browser holds in one sweep. The resulting log puts the criminal persona and the real person in the same archive, a forum login beside a personal mailbox, an extortion messenger beside autofill entries carrying a name and a home address. Researchers have used logs like that to tie aliases to real identities in a run of published cases since 2023. The mistake is rarely one bad password. It is living two lives on one machine.
Separated by account, joined by the machine
People who run a criminal persona usually take care over the persona itself. The handle is new, the mailbox is a privacy-focused one, the payments go through an account opened somewhere else. All of that separates identities at the level of accounts.
An infostealer does not work at that level. It takes the machine: every saved password in every browser profile, the session cookies, the autofill store, the list of installed software, the system's language and network details, and in some cases the browsing history. If the persona and the person were ever used on the same computer, the log holds both, and anyone reading it can see which password, address or email the two have in common. There is a longer account of what a single sweep takes in stealer logs are the easiest path to a data breach.
How often it happens
More often than the people involved would like. In August 2023 Hudson Rock reported finding credentials for cybercrime forums on roughly 120,000 infected computers, and judged that about 100,000 of those machines belonged to hackers rather than to curious visitors, BleepingComputer reported. The same logs carried other email addresses and usernames, autofill entries with names, addresses and phone numbers, and system details such as computer names and IP addresses. Those are exactly the fields needed to put a person behind a forum account.
The forum with the most infected members was Nulled.to, with more than 57,000. That is less surprising than it sounds. When police took Nulled and Cracked offline in January 2025, Europol described the pair as marketplaces for "stolen data, malware or hacking tools" (TechCrunch). A community built on swapping executables is a community whose members run other people's executables.
Four cases from the public record
In each case below, the attribution is the published conclusion of the researchers or journalists involved, not a finding by a court.
An access broker caught in their own log
In July 2023 Hudson Rock described a seller known as La_Citrix, active on Russian-speaking forums since 2020, who sold access to companies' Citrix, VPN and remote desktop servers and also sold stealer logs. According to Hudson Rock's write-up, the seller accidentally infected their own computer. The browser's autofill held a first and last name, an address and a phone number. The installed software included qTox, a messenger the researchers associate with ransomware crews. The saved credentials, corporate logins used to reach victims' servers, tied the one machine to 291 companies. Hudson Rock did not publish the seller's name and said the material would go to law enforcement.
A teenager on a shared family computer
Rey was one of the administrators of the Hellcat ransomware group, and later of the Scattered LAPSUS$ Hunters channel. In March 2025 KELA reported that Rey had been infected twice under an earlier alias in early 2024, and concluded that one of the infected machines was likely a shared computer used by a family member. When KrebsOnSecurity followed the trail in November 2025, that detail is what narrowed it to a household: several people's autofill entries on one Windows device pointed to a single family surname and address, and one profile kept visiting an airline's internal staff sites, which matched something the user had said in chats. Krebs contacted a parent, and Rey then confirmed the identification. Rey was 15 when identified, so the real name is not repeated here.
A development machine linked to the Bybit theft
In February 2025 North Korea stole about $1.5 billion in virtual assets from the exchange Bybit, according to the FBI. In December 2025 Hudson Rock published an analysis of an infected machine that it attributes to a North Korean developer. The machine was set up for malware work, with an executable packer installed alongside Visual Studio, and its traffic left through a VPN exit in the United States. Its browser language was Chinese, and its translation history showed text being turned into Korean. Among the saved credentials was an email address that, according to separate research the write-up cites, had been used to register a lookalike Bybit domain hours before the theft. One saved login connected a development rig to the infrastructure of the heist.
An operator infected through game mods
In March 2026 Hudson Rock described a second machine, which it links to a suspected North Korean IT worker operation. The infection, it says, most likely followed searches for mod menus and script executors for a Grand Theft Auto V multiplayer platform, and the download of archives named "Setup". The log held five Chrome profiles and an Edge profile, handles on cloud and hosting providers, a dozen crypto wallet instances and around 4,000 search queries, among them searches for wallet-draining kits and remote developer jobs. Hudson Rock notes that the person at the keyboard may have been a local facilitator hosting the machine rather than the operative, which is the right caution to carry into reading any log.
Why the people who spread infostealers catch them
The cases share a short list of causes, and none of them is specific to crime.
- They run tools from strangers. The forums where they trade checkers, crackers and builders are, in Europol's description, also marketplaces for malware. A free tool from an anonymous seller carries the same risk for a criminal as for anyone else.
- They install game cheats and mods. The second North Korean machine is the clearest example. Cheats arrive as executables from unofficial sites, which is how commodity stealers arrive too, and they infect whoever is at the keyboard.
- They share the computer. A family PC or a facilitator's machine carries other people's autofill entries, which is how Rey's household was found.
- They handle live malware where they live. By Hudson Rock's account, La_Citrix was infected in the course of infecting others. Sorting logs or testing payloads on a personal computer leaves one mistake between an operator and their own log.
What in a log ties a person together
None of the identifying fields is exotic. They are the ordinary contents of a browser that someone uses every day.
- Autofill. Names, home addresses and phone numbers typed into shopping and delivery forms. In the La_Citrix log, this alone named the owner.
- Saved logins side by side. A forum account and a personal mailbox in the same password store, sometimes sharing a password, which is the join a researcher looks for first.
- Installed software. An encrypted messenger, a packer or a wallet says what the machine is for.
- System details. Computer name, IP address and browser language place the machine somewhere.
- History. Searches and translations show what the owner was working on and in which language, as in both North Korean cases.
- Other users. On a shared machine, every other profile is a lead to the household.
What a log can and cannot prove
A stealer log is strong evidence about a machine and weaker evidence about a person. It shows what one computer held at the moment it was swept. It does not show who was sitting at it, whether the owner lent it out, or whether a given credential belonged to the owner or to one of the owner's victims, which is a real ambiguity in a log taken from someone who trades logs.
The published cases treat it that way. Krebs did not rest on the log, and confirmed it with the family and then with Rey. KELA's same report linked Rey's fellow Hellcat member Pryx mostly through other material, and called one stealer-based link to Pryx only a "possible circumstantial association". Hudson Rock raises the facilitator question in its own write-up. A log tells an investigator where to look next. Attribution is the work that comes after it.
The same mechanics apply to everyone else
Criminals are the dramatic version of an ordinary problem. Most people run several lives on one machine as well: a work account beside a personal one, a company's single sign-on beside a gaming launcher, a child's downloads on a parent's laptop. When that machine is swept, the log joins them in exactly the same way.
For an organisation, the useful question is not only whether its own systems were breached but whether its logins have surfaced in a capture from somebody's computer, often a personal one it never managed. There is a separate guide to checking a company's exposure in stealer logs, and the compromised device records surface looks up captures by email address, username or domain.
Questions people ask
How do hackers get caught by infostealers?
The same commodity malware they sell or use lands on their own computer, often through a cracked tool, a game cheat or a shared machine. The log it produces holds their criminal accounts and their personal details together. Researchers who later read the log can connect the two through a shared password, email address or home address.
Can a stealer log identify a real person?
It can point to one. Autofill entries often carry a name, address and phone number, and saved logins show which accounts were used together. A log describes a machine rather than a person, though, so careful published attributions confirm the identity through other evidence before naming anyone.
Why would a hacker's own computer get infected?
For the same reasons anyone's does: running executables from strangers, installing game mods and cheats, and sharing a computer with people who do. Someone who trades tools on forums that also sell malware is, if anything, more exposed than the average user.
What does an infostealer log contain?
Typically the browser's saved passwords, session cookies, autofill entries and saved cards, plus system details such as the computer name, IP address, language and installed software. Some infections also take browsing history, crypto wallet files and a screenshot.
How can I check whether my own details are in a stealer log?
Search the email addresses and usernames you actually use. A match against a device capture means the whole machine, not one account, should be treated as compromised. The free exposure check covers device captures alongside breach records.
