The presence of credentials in leaked “stealer logs” indicates his device was infected.
Read in full here:
