Researchers Link the 117 Boss2 Dump to 5,123 Stolen Credentials Leaked on Telegram

In June 2023, HEROIC researchers identified and indexed a stealer log file uploaded to Telegram by an actor using the handle 117 Boss2. The dataset contained 5,123 records, each holding email addresses, plaintext passwords, and the URLs of targeted services harvested from infected endpoints. The upload is consistent with ongoing activity by Telegram-based threat actors who distribute stealer log collections to buyers and fellow criminals through private and semi-public channels on the platform.

Why This Is Dangerous

Researchers tracking this category of breach note that stealer log dumps are among the most operationally ready datasets in circulation. Unlike cracked hash files or aged database leaks, stealer logs contain passwords that were confirmed working at the moment of extraction. The 117 Boss2 dataset includes service URLs alongside every credential, providing attackers with a structured guide to which platforms to target first. Security teams who analyse these files consistently find that the credentials begin to be used for account takeover within hours of the dump going live.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs (service endpoints harvested from infected devices)

Why This Matters

Five thousand compromised records may appear modest by database breach standards, but stealer log data operates differently. Because the credentials are tied to specific services and are known to work, they enable direct account takeover without the friction of cracking or guessing. Credential stuffing attacks using this kind of data succeed at a higher rate than attacks using older, hashed breach databases. The resulting chain of identity theft, financial fraud, and account compromise can affect victims for months. Password reuse means a single stolen credential can unlock five, ten, or twenty additionaly accounts.

How Stealer Logs Work

Information stealer malware is distributed through phishing campaigns, trojanized software packages, and compromised websites. Once installed on a device, it enumerates saved browser credentials, session tokens, clipboard history, and autofill data before packaging the results into a compressed log file. That file is then sent to the attacker's collection infrastructure, which in the case of the 117 Boss2 upload involved a Telegram channel. The operator aggregated logs from multiple infected devices into a single archive and made it available for download. Victims recieve no notification from any service provider because no server-side breach occured. The entire theft happened on the victim's device, invisible to conventional breach detection systems.

Check If You Are Affected

HEROIC researchers have catalogued the 117 Boss2 stealer log in the HEROIC breach database, which now indexes more than 400 billion compromised records. A free email search will show whether your adress appears in this dataset or any other indexed breach. Because stealer log dumps never generate official disclosure notices, this type of search is often the only way to detect device-level credential theft. Search your email now to find out if your data was stolen.