1,543 Passwords Stolen by Malware: 1.5K France 21.06 Leak

How Malware Behind "1.5K France 21.06" Captured 1,543 Records

HEROIC analysts identified a stealer log named "1.5K France 21.06," uploaded to a Telegram channel on 21-Jun-2026. The file contains 1,543 records, each pairing an email address with a plaintext password and the URL of the site the credentials were captured from, all pulled from infected devices by information-stealing malware.

Why the 1.5K France 21.06 Stealer Log Is Dangerous

What makes malware-harvested data like this so dangerous is that it comes straight from the source, with no cracking or guessing required. The malware simply read what was already saved in the browser, so each record already links a specific email and password to the exact website it unlocks. Because the passwords are in plaintext, anyone who gets the file can use them immediately.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the websites where the credentials were used

Why This Matters

With 1,543 working email and password pairs harvested this way, the direct risk is account takeover on whichever site each record came from. It also drives credential stuffing: if the same password was reused elsewhere, those accounts are exposed too, regardless of whether the malware specifically targeted them.

How Stealer Logs Work

This file's name points directly to how it was made: information-stealing malware infects a device, quietly reads through the browser's saved passwords and active sessions, and sends everything it finds back to whoever is running the malware. The result is a plain text file listing exactly which login works on which website. Files like this one are then packaged and traded on Telegram, which is exactly where HEROIC analysts found it.

Check If You Are Affected

With over 1,500 records pulled directly from infected devices, it's worth checking rather than assuming you weren't one of them. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including stealer logs like this one, and tells you immediately if you've been exposed. If you get a match, change that password right away and avoid reusing it anywhere else.