Search Your Email Now: 270028_KE Stealer Exposed 166 Accounts

HEROIC analysts identified the 270028_KE_105.160.95.72_07-06-23 stealer log circulating on Telegram in June 2023. The file exposed 166 records harvested from infected endpoints in Kenya, containing email addresses, plaintext passwords, and the URLs of targeted websites. With 166 records, this represents a meaningful number of individuals whose credentials are now in the hands of unknown threat actors.

Why This Stealer Log Is Dangerous

This log gives attackers 166 working email and password combinations, each already matched to a specific website. None of the passwords are hashed or encoded. They are available exactly as typed. An attacker can immediately attempt logins across every URL listed in the file. The scale of this log suggests a sustained period of infection and credential harvesting.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs (exact websites associated with each stolen credential)

Why It Matters Now

A dataset of 166 plaintext credentials is highly attractive to attackers running automated tools. Credential stuffing campaigns can test each record against dozens of popular services in minutes. Victims may face unauthorized logins to email accounts, social media, financial platforms, and any other service where the same password was reused. Each compromised account can then be used to launch further attacks.

How Stealer Logs Work

Infostealer malware is typically installed without the victim's knowledge through phishing links, malicious email attachments, or software downloaded from unofficial sources. Once running, it systematically extracts saved browser passwords, active session tokens, and form autofill data. This information is bundled into a log file and sent to the attacker. The 270028_KE log was then shared on Telegram where it became accessible to anyone in the channel.

Check If You Are Affected

Search your email now using HEROIC's free breach scanner. With more than 400 billion records indexed, HEROIC can tell you instantly whether your credentials have been exposed. Do not wait for an attacker to use them first.