iTnews reported on 30 October 2026 that New Zealand researchers Will Frame, who runs the free Restealer infostealer monitoring service, and Jacob Torrey, head of labs at Thinkst Applied Research, deliberately infected their own machines with malware to plant a new type of Canarytoken built from session cookies in infostealer operators' databases. (source: iTnews)

The researchers told iTnews: "There's an [approximately] three day window post-compromise where nothing happens, then a few initial checks to see if the credentials are valid, then you can tell once they've been sold as the login attempts shoot up."

Frame said the early checks were almost certainly log providers checking the logs before releasing them to subscribers. (source: iTnews)

According to iTnews, Frame said infostealer log subscriptions range from as little as US$300 for lifetime access from newcomers to US$5,000–US$10,000 from larger providers, with session cookies, which can let an attacker into an account that has already passed a multifactor authentication check, included in whole logs at no extra cost. iTnews says the pair will present the full results at the Kawaiicon security conference in Wellington on Friday 30 October. (source: iTnews)