Glovo Users Targeted: white0storme Leak Exposes 1,261 Logins

On 15-Dec-2022, HEROIC analysts identified a stealer log file, shared by a Telegram user under the label "1261 Glovo Hits By white0storme," containing 1,261 records. The file specifically targets Glovo accounts and includes email addresses, plaintext passwords, and the URLs those credentials log into.

Why Glovo Users Are the Target Here

The file's own label calls out its target directly: Glovo, the delivery app, and a threat actor going by "white0storme" who compiled the "hits," meaning confirmed working logins. That focus matters because it tells you exactly who's at risk, anyone with a Glovo account tied to one of these 1,261 records has a plaintext password sitting right next to the URL that opens it, ready for an attacker to use immediately.

What Was Exposed

• Email addresses
• Plaintext passwords
• The login URLs tied to each set of credentials

Why This Matters

Anyone in this file faces immediate account takeover risk on Glovo itself, since the exact login page and password are both included. The risk doesn't stop there either: if the same password was used on other accounts, attackers can try that same email and password combination elsewhere in a tactic known as credential stuffing, spreading the damage beyond the original app.

How Stealer Logs Work

Stealer logs are produced by malware that infects a device, often through a fake download, cracked software, or a malicious attachment, and then quietly copies whatever the browser has saved: passwords, autofill data, and the web addresses tied to each login. Threat actors like white0storme then sort that stolen data by target, compiling app-specific files like this Glovo-focused log, and share or sell them through channels such as Telegram.

Check If You Are Affected

If you've ever logged into Glovo or a similar app, it's worth checking whether your information has surfaced. HEROIC's free breach scanner checks your email address against more than 400 billion leaked and dark web records, so you can find out quickly and change any exposed passwords before someone else uses them.