4,566 Credentials in 272 Stealer Log Surfaced on Telegram

In March 2023, a small file slipped onto a Telegram channel without fanfare. HEROIC analysts confirmed the drop on March 6, 2023, and logged it as 272 uploaded by a Telegram User. Inside were 4,566 records of email addresses, plaintext passwords, and the URLs those credentials were tied to.

Why the 272 Stealer Log Is Dangerous

The file is modest in size, which is exactly what makes it usefull to attackers. Smaller dumps atract less attention from defenders and get folded quietly into larger combolists. Every credential pair inside is plaintext, meaning no cracking is required before reuse.

What Was Exposed in the 272 Stealer Log

• 4,566 email address entries
• Matching plaintext passwords
• Login URLs that pinpoint the target service
• Session context from malware-infected browsers

Why This Matters

Even a 4,566-record log can seed thousands of account takeover attemts. Credential stuffing bots hammer banking, retail, and workplace portals with these pairs until something opens. From there, fraudsters pivot to email resets, invoice scams, and full identity theft before most victims notice a thing.

How a Stealer Log Like the 272 File Works

Infostealer malware such as RedLine, Vidar, and Raccoon lands through pirated software, phishing links, or drive-by downloads. It quietly copies saved browser logins, session cookies, and autofill entries, then ships the bundle back to an operator. Those operators post trimmed logs like 272 on Telegram to build reputation, seed bigger deals, or cycle fresh credentials into the dark web economy.

Check If You Are Affected

HEROIC indexes more than 400 billion leaked records from breaches, stealer logs, and dark web forums. A free scan with the HEROIC breach scanner will reveal whether your email or passwords show up inside the 272 file or any other known exposure.