Overview
Stolen credentials are a commodity on the dark web. Understanding how they're sold, priced, and distributed helps security teams appreciate the urgency of credential monitoring.
Where Credentials Are Sold
Dedicated Log Shops
Specialized marketplaces sell stealer log data as indexed, searchable databases. Notable examples include:
- Russian Market — one of the largest stealer log shops, offering credentials indexed by URL, country, and infection date
- Genesis Market (seized by law enforcement in 2023, but successors have appeared) — sold "digital fingerprints" including cookies, browser profiles, and saved passwords
These shops function like e-commerce sites — buyers can search by domain, filter by country, and purchase individual log sets.
Telegram Channels
An increasing volume of credential distribution happens on Telegram:
- Free dump channels — bulk stealer log releases, often containing millions of credentials, shared for reputation building
- Premium channels — paid subscriptions for exclusive, high-quality log sets
- Private groups — invite-only communities trading fresh logs
Telegram's accessibility (no dark web browser required) and encryption make it a preferred platform for credential trading.
Dark Web Forums
Traditional dark web forums serve as:
- Marketplaces for bulk credential databases
- Auction sites for high-value targets (admin accounts, financial services)
- Reputation systems for sellers
How Credentials Are Packaged
Stealer Log Bundles
Individual stealer log sets typically include:
- All saved passwords from the infected device (in URL:Login:Password format)
- Browser cookies (including authentication session cookies)
- System information (OS version, IP address, geolocation)
- Screenshot of the desktop at the time of infection
- Autofill data (names, addresses, credit card numbers)
Combo Lists
Aggregated credential lists compiled from multiple sources:
- Email/password pairs without additional context
- Often deduplicated and sorted by domain
- Used for large-scale credential stuffing campaigns
Pricing
| Type | Typical Price |
|---|---|
| Single stealer log (low value) | $1–5 |
| Single stealer log (corporate/banking) | $10–50 |
| Corporate admin credential set | $50–500+ |
| Bulk stealer log pack (1000+ logs) | $100–500 |
| Fresh combo list (millions of entries) | $10–100 |
| Subscription to stealer log service | $50–200/month |
Corporate credentials command higher prices because they provide access to internal systems, email, VPN, and potentially sensitive data.
Timeline: From Infection to Sale
| Event | Typical Timeframe |
|---|---|
| Device infected | T=0 |
| Credentials harvested | Seconds to minutes |
| Data exfiltrated to C2 server | Minutes |
| Data packaged for sale | Hours |
| Listed on marketplace | 1–24 hours |
| Purchased by buyer | 1–7 days |
| Credentials used in attack | 1–30 days |
The critical takeaway: your credentials can go from stolen to for-sale within hours. Without monitoring, you won't know until an unauthorized access event occurs — which could be days or weeks later.
Why Monitoring Is Critical
Given this timeline:
- Without monitoring: Average detection time is 287 days
- With Verusight Pro Guard: Detection within 30 minutes of new data ingestion
The difference between hours and months of exposure can mean the difference between a contained incident and a full-blown breach.