The 226_Boss Dump Contains Exactly 9,990 Email and Password Pairs From Infected Devices

In June 2023, HEROIC researchers captured and indexed a stealer log file uploaded to Telegram by an actor using the handle 226_Boss. The dataset contained 9,990 records, each consisting of an email address, a plaintext password, and the URL of the specific online service targeted during the malware infection. The data was not obtained through a server-side hack. It was harvested directly from infected devices by information-stealing malware before being uploaded to Telegram, where it was made available to any subscriber of the channel.

Why This Is Dangerous

The 226_Boss dump stands out among stealer log datasets for its scale. Nearly 10,000 verified credential pairs, each tied to a specific service URL, gives attackers an unusually complete picture of what to target and where. Because stealer logs capture passwords in plaintext at the moment of theft, there is no cracking required. Automated tools can begin testing these credentials against live services within minutes of downloading the file. The high volume makes this dataset particularly useful for large-scale credential stuffing operations where attackers cast a wide net accross many platforms.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs (service endpoints harvested from each infected device)

Why This Matters

At 9,990 records, the 226_Boss dataset has the capacity to drive widespread account takeover, identity theft, and financial fraud. When attackers test these credentials against multiple services, they leverage the common habit of password reuse to unlock accounts far beyond the original point of compromise. Each successful login can expose personal data stored in that account, financial instruments linked to it, and communications that could be exploited for further attacks. Victims do not recieve notifications because no service provider was breached. The harm can accumulate undetected for weeks before a victim notices unauthorised activity across their seperate accounts.

How Stealer Logs Work

Stealer malware is engineered to blend in. It is usually installed through phishing links, fake software updates, or malicious browser extensions, and it begins harvesting data immediately without displaying any visible signs of activity. The malware collects browser-saved credentials, session cookies, autofill entries, and clipboard contents, packaging them into a compressed log file that is sent to the attacker. The 226_Boss operator aggregated these logs from multiple infected devices and uploaded the bundle to Telegram. Because the infection occured on victims' personal devices rather than at a corporate server, no standard breach disclosure process was ever triggered, and victims had no way to learn their credentials had been stolen.

Check If You Are Affected

The 226_Boss stealer log is now indexed in HEROIC's breach database alongside more than 400 billion other compromised records. HEROIC's free scanner searches your email address against this entire database in seconds. Because stealer log breaches never generate official notifications, a HEROIC search is often the only reliable way to find out if your adress appeared in a dump like this one. Search your email now to see if your credentials were stolen.