1,668 202303_dcrat_192_BONUS Passwords Surfaced on the Dark Web

HEROIC found the 202303_dcrat_192_BONUS stealer log on March 13, 2023, exposing 1,668 records with email addresses, plaintext passwords, and URLs from infected endpoints distributed on Telegram as a bonus release.

Why the 202303_dcrat_192_BONUS Breach Is Dangerous

The dcrat designation in this filename refers to DCRat, a remote access trojan sold as malware-as-a-service in criminal forums. DCRat operators capture credentials from infected machines and package them into numbered series. The BONUS label means this 1,668-record dump was released outside the main sequence, giving subscribers extra material. Every record remains fully exploitable despite the small count.

What Was Exposed in the 202303_dcrat_192_BONUS Leak

• Email addresses captured from infected browser sessions
• Plaintext passwords with no hashing or encryption applied
• Login URLs identifying the specific services each credential accesses
• API host details from compromised endpoint environments

Why This 202303_dcrat_192_BONUS Data Puts You at Risk

Credential stuffing tools can process 1,668 email-password pairs against banks, email providers, and SaaS platforms in seconds. Any service where the victim reused the same password becomes an immediate target. From an email inbox, attackers trigger password resets for every linked account, leading to identity theft, wire fraud, and data exfiltration.

How a Stealer Log Works

DCRat and similar remote access trojans infect devices through cracked software, phishing links, and fake software downloads. The malware captures saved browser passwords, autofill data, and session cookies, then transmits the bundle to an operator. Operators package the haul into numbered series with bonus releases and distribute them on Telegram channels for broad reach among criminal actors.

Check If Your Data Was Exposed

HEROIC operates one of the world's largest breach databases, covering more than 400 billion leaked records. Use HEROIC's free breach scanner to check if your email address or credentials appeared in the 202303_dcrat_192_BONUS leak or thousands of other breaches in our database.