Data exfiltration is the unauthorized movement of sensitive data from an organization's systems to external attacker-controlled storage. Infostealer malware performs automated exfiltration as its core function, packaging credentials, cookies, files, and system metadata into logs and uploading them to criminal servers.
Detecting exfiltration after the fact is difficult because stealer uploads use HTTPS and common CDN infrastructure. The most effective defense is catching the infection before exfiltration completes, or monitoring stealer log markets for your data immediately after.