How the 1.9M URL LOG PASS Malware Led to 1.6 Million Stolen Logins on Telegram

HEROIC analysts documented a massive stealer log upload to Telegram on November 20, 2025. The file, listed as "1.9M URL LOG PASS - TXT CLOUD," contained 1,672,952 records when verified -- slightly below the advertised 1.9 million but still one of the larger single uploads catalogued during that period. Each record included an email address, a plaintext password, and the URL of the service the login belonged to. The "TXT CLOUD" designation indicates the file was distributed via a cloud text storage service, a common distribution method used to bypass Telegram file size limits.

Why 1.6 Million URL Log Pass Records Should Concern You Personally

A file this size is not a targeted attack -- it is a sweep. The credentials come from victims across many countries, many industries, and many different services. An attacker working through a file of this scale does not need to know who you are. They just need your email and password to match one entry in 1.6 million. If you have ever saved a password in your browser, used a public or unprotected Wi-Fi network, or downloaded anything from an unofficial source, your credentials may have been harvested by the malware that produced this file.

What Was Exposed in the 1.9M URL LOG PASS TXT Cloud Dump

• Email addresses
• Plaintext passwords (usable directly, no processing needed)
• URLs indicating exactly which services the credentials belong to

Why Cloud-Hosted Stealer Logs Are Harder to Take Down

When cybercriminals host credential files on cloud text storage platforms rather than directly on Telegram, they gain several advantages. Cloud links do not expire immediately, allowing wider distribution over a longer time window. Multiple people can download the same link simultaneously without alerting the original uploader. And takedowns require action from a separate platform with its own review process, giving the file extra hours or days of live access. A 1.6 million record file distributed this way could be downloaded by hundreds of buyers before any takedown request is even received. That is why cloud-hosted stealer logs tend to have a disproportionatly high reach relative to their file size.

How Malware Produces Credential Files of This Scale

A credential file with nearly 1.7 million entries is not the work of one piece of malware on one machine. It is the aggregated output of a malware distribution network, where the same malicious code is deployed across thousands of victim devices through phishing campaigns, cracked software, and malicious browser extensions. Each infected device contributes its saved passwords, session cookies, and form data to a central collection point. The data is then cleaned, sorted by format, and released in bulk uploads. The TXT cloud format used here is typical of operators who want efficient distribution without maintaining their own hosting infrastracture.

Check Whether Your Email Was in the 1.9M TXT Cloud Release

With 1.6 million records in circulation from this single Telegram upload, the risk of exposure is real. HEROIC's free breach scanner checks your email address against more than 400 billion exposed records, including large-scale cloud-distributed stealer logs like this one. Search now to find out whether your credentials appeared in this dump -- and if they did, start changing your passwords immediately, beginning with your email account and any financial services.