2,002 Plaintext Login Credentials in 106 Stealer Log

HEROIC catalogued 2,002 records inside a stealer log uploaded to a Telegram channel on March 6, 2023. The file, tracked as 106 uploaded by a Telegram User, contains email addresses, plaintext passwords, and URLs pulled from infected endpoints.

Why the 106 Stealer Log Is Dangerous

The payload pairs readable passwords with the exact login URL each victim used. That detail removes the guesswork for attackers and makes the 106 file a plug-and-play asset for automateed account takeover tools.

What Was Exposed in the 106 Stealer Log

• 2,002 unique email addresses
• Plaintext passwords copied from browser stores
• Target login URLs for each credential pair
• Metadata from the compromised user sessions

Why This Matters

Plaintext credentials fuel the three attacks that cost consumers the most money: credential stuffing, account takeover, and identity theft. With the 106 file in hand, attackers can test the same email and password against banking, email, retail, and SaaS portals until an account opens, then move laterally into payment details, saved adresses, and linked services.

How a Stealer Log Like the 106 File Works

Infostealer malware, including RedLine, Raccoon, and Vidar, infects devices through cracked software, malicious ads, and phishing lures. Once installed, it scrapes saved browser passwords, cookies, and autofill data, then exfiltrates everything to an operator. The operator resells or freely distributes the resulting logs on Telegram and dark web forums, feeding combolists that power ongoing credential stuffing waves.

Check If You Are Affected

HEROIC maintains one of the largest breach intelligence databases anywhere, with more than 400 billion records indexed from leaks, stealer logs, and dark web sources. Run a free scan with the HEROIC breach scanner to see whether your email or password is inside the 106 stealer log or any other known exposure.