Inside the 1.5k BG Stealer Log: 1,460 Stolen Passwords Exposed

HEROIC analysts have identified a stealer log labeled "1.5k BG," uploaded to a Telegram channel in April 2026. The file contains 1,460 records, likely tied to Bulgarian accounts based on its naming, and includes email addresses, plaintext passwords, and the URLs of the sites those logins belong to.

Why This Is Dangerous

This file is not a scrambled or hashed dump that requires cracking. It is a ready-to-use list pairing each victim's email and password with the exact website the credentials work on. That means anyone who obtains the log can start testing logins immediately, with no technical skill required.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the associated login pages

Why This Matters

With 1,460 working credential sets now circulating, the danger extends past the original sites they were stolen from. Reused passwords let attackers pivot into email, banking, and social accounts through credential stuffing, turning one stolen login into a much wider identity theft or fraud problem.

Inside the 1.5k BG Stealer Log: How Malware Harvests Passwords

Stealer logs like this one come from infostealer malware that infects a device through fake software, cracked games, or malicious attachments. Once active, it quietly reads the passwords and autofill data saved in the browser, along with the web addresses tied to them, and compiles everything into a text file. Files like "1.5k BG" are then dropped into Telegram channels, where thousands of people can view or download them for free.

Check If You Are Affected

Stealer log leaks like this one are added to HEROIC's database constantly. Run a free scan against more than 400 billion leaked records to find out if your email and passwords have shown up in this breach or any other, then update any exposed passwords right away.