10 Plaintext Passwords Dumped in the Spookstore Leak

HEROIC detected a stealer log file distributed by a Telegram account called "Spookstore" in September 2025. This compact dump contains 10 records, each exposing an email address, a plaintext password, and the URL where the credential was captured. While the number is small, each record represents a real individual whose account credentials are now publicly available for exploitation.

Every Plaintext Password Is a Direct Threat

All 10 passwords in this leak are stored in plaintext with no encryption whatsoever. An attacker can use any of these credentials immediately — no cracking tools required, no computation needed. Even in a dump this small, the impact on each affected individual can be severe, particularly if these passwords are reused across other services.

What Was Exposed

• Email Addresses — account identifiers that can be used for login attempts and phishing
• Plaintext Passwords — unencrypted, immediately usable credentials
• URLs — the specific websites where credentials were actively captured by malware

Small Dumps Still Fuel Credential Stuffing

Attackers do not ignore small credential sets. In fact, micro-dumps from operators like Spookstore are often fresher and more reliable than massive compilations. Each of the 10 credential pairs can be tested against hundreds of services, and if any of those users reuse their passwords, the attacker gains access to far more than what this single dump contains. Small, targeted leaks are often the precursors to larger attacks.

Stealer Logs from Telegram Channels

The Spookstore Telegram channel is one of many underground outlets where stolen credentials are freely shared or sold. The data originates from infostealer malware that infects victims' devices through deceptive downloads or phishing links. Once active, the malware extracts saved passwords from web browsers, captures form submissions, and transmits everything to the attacker's infrastructure. Even a small batch of 10 records indicates active malware operations that may produce larger dumps in the future.

Check If Your Credentials Were Exposed

HEROIC's breach scanner covers over 400 billion records from data breaches, stealer logs, and dark web sources. Search your email address to determine whether your credentials were included in the Spookstore dump or any of the thousands of other breaches in HEROIC's database. If exposed, change your passwords right away and activate two-factor authentication on all important accounts.