186,708 Accounts Exposed by the Mansory 2 Stealer Log Dump

In December 2025, HEROIC analysts identified a stealer log file titled "mansory 2," uploaded to a Telegram channel by an unidentified user. The file contained 186,708 records, each made up of an email address, a plaintext password, and the URL of the site the credentials were used on.

Why the Mansory 2 Stealer Log Is Dangerous

With more than 186,000 individual credential sets, this log gives whoever downloads it a large pool of working logins to work through. Because the passwords are stored in plaintext, there is no barrier between having the file and being able to use the credentials, making this kind of leak attractive to criminals looking to move quickly.

What Was Exposed in the Mansory 2 Log

• Email addresses
• Plaintext passwords tied to each account
• URLs identifying where each credential pair was used

Why This Matters

A file of this size gives attackers enough volume to run large-scale credential stuffing campaigns, feeding all 186,708 pairs into automated tools that check the logins against banking, email, and shopping sites. Anyone whose email and password appear here faces a real risk of account takeover if they reused that password anywhere else, which can lead to financial fraud or identity theft.

How Stealer Logs Work

Stealer logs like this one are assembled from data taken off many individually infected computers rather than a single hacked server. Info-stealing malware, often spread through cracked software or fake downloads, quietly copies saved browser credentials and sends them back to whoever controls the malware. Those results get combined into large batch files, sometimes numbered as later entries in a series like "mansory 2," and then shared or sold on Telegram and similar platforms.

Check If You Are Affected

With a leak this size, checking your exposure is worth doing. HEROIC's free breach scanner searches more than 400 billion leaked records, including stealer logs like this one, and can tell you in seconds if your email address was part of it.