On the darknet, not just stolen data, but data that can still be used, is increasingly valued. According to BI.ZONE, fresh stealer logs have risen in price by almost 13% over the year, and data from Russian users accounts for about 14–18% of the total supply.
Such archives may contain logins and passwords, cookies, session tokens, access to email, VPN, and cloud services. Cookies and tokens are especially valuable: while they are active, an attacker can sometimes access an account without re-entering a password and two-factor authentication. Therefore, every hour counts.
One archive is sold for an average of 10–15 dollars. More recent data is also distributed by subscription through closed servers and Telegram channels — such access costs about 250–300 dollars per month. The better the information is verified and the fewer people have received it, the higher the price.
Logs are used for account takeover, phishing, and penetration into corporate systems. Sometimes they appear on underground platforms just a few hours after a device is infected.
The only way to protect yourself is speed: if you suspect a stealer, you should immediately change passwords, end active sessions, and revoke tokens. For ordinary users, the main risks are pirated software and suspicious files from unknown sources.