One Stealer Log. 105 Records. The 105X Mix Credentials.

HEROIC analysts identified this stealer log on May 21, 2026. The breach exposed 105 records, with stolen data including email addresses, plaintext passwords, and URLs. The source is identified as 105X MIX uploaded by a Telegram User.

Why This Is Dangerous

Even a small stealer log like this one poses a real threat to the individuals whose credentials are included. Each of the 105 stolen records contains a working email address, a plaintext password, and a URL showing exactly where it was used. For those affected, the risk is the same as in any larger breach: attackers have everything needed to attempt unauthorized logins and account takeovers right away.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs

Why This Matters

The 105 stolen credentials in this log expose affected individuals to account takeover, credential stuffing across multiple platforms, identity theft, and financial fraud. Smaller breaches often go unnoticed, giving attackers additional time to exploit stolen credentials before victims are aware that their information is at risk. Every exposed account represents a real person who may not yet know they are compromised.

How a Stealer Log Works

A stealer log is produced when malware installed on a device collects login credentials from browsers, saved passwords, and active sessions. The data is compiled into a file and shared through Telegram channels, where it is distributed to other attackers regardless of the size of the collection. Even small batches of credentials are valuable to those looking for verified email and password combinations.

Check If You Are Affected

HEROIC offers a free breach scanner that searches 400 billion records. Search your email address now to see if your credentials appear here or elsewhere. Free, takes seconds.