US-Based Victims Named in 104_Boss2 Leak of 3,977 Credentials

The 104_Boss2 stealer log, posted to Telegram in September 2023, is tagged as United States in origin, and its 3,977 records reflect a country whose users remain a constant and reliable target for the people building these logs.

Why This Is Dangerous

Being flagged as US-based doesn't make this leak special, but it does mean the accounts inside are likely tied to services Americans use every day: banking apps, email providers, streaming platforms. Attackers know this too, so US-tagged logs often get prioritized because the payout potential is higher and more predictable.

What Was Exposed

• Endpoint and host records from infected devices
• Email addresses linked to US-based accounts
• Plaintext passwords collected at the moment of infection

Why This Matters

Leaks tagged by country tend to move faster through criminal marketplaces because buyers can target specific demographics. A US-tagged file like this one gets scooped up quickly by people running credential stuffing campaigns aimed at American financial institutions and retailers, so the window to react shrinks fast.

How Stealer Logs Work

The malware that produced this log likely arrived through a phishing email or a cracked software download, common infection vectors regardless of the victim's location. Once running, it pulled saved logins from the browser and shipped them off, later formatted into the file now circulating as 104_Boss2.

Check If You Are Affected

HEROIC has indexed over 400 billion (400B+) leaked records across breaches and stealer logs worldwide, including many tied to US accounts specifically. Run a free scan today to check if your credentials appear in this leak, and change your password right away if they do.