2,929 Records from epicgames.com v bucks receipt Leaked in Stealer Log Attack

In June 2024, a Telegram user posted a stealer log file titled "epicgames.com v bucks receipt" containing 2,929 records. The file held plaintext passwords, email adresses, and URLs harvested from infected devices, with a clear focus on accounts connected to the Epic Games platform. Even at under 3,000 records, this kind of targeted leak is particularly concerning because the data is specific and actionable, giving attackers direct access to gaming accounts that may hold real monetary value.

Why This Is Dangerous

Gaming accounts are a high-value target for credential thieves. Epic Games accounts linked to Fortnite often contain V-Bucks, a purchased in-game currency, as well as rare skins and items that can be sold or traded. A stolen account with a large V-Bucks balance is worth real money on underground marketplaces, which is why stealer malware frequently targets gaming platforms seperately from general credential harvesting.

The plaintext passwords in this file mean attackers can log in directly without any cracking or brute-force attempts. Combined with the email addresses, the data provides everything needed to take over an account immediately, change the password, and lock the original owner out entirely.

Beyond the gaming-specific risk, many people use the same password for their Epic Games account that they use for email or other services. A single credential pair from this file could open doors well beyond just a gaming platform.

What Was Exposed

• Email addresses tied to Epic Games platform accounts
• Plaintext passwords with no hashing or encryption
• URLs indicating which gaming and related services were accessed
• API host data from connected application sessions
• Endpoint device information from infected machines
• Potential session tokens from active Epic Games logins
• Account access data that may reflect in-game purchase history

Why This Matters

The naming convention of this file, referencing V-Bucks receipts specifically, suggests the person who created or distributed this log had gaming accounts as a deliberate target rather than a byproduct of broader credential harvesting. That level of specificity means the data was likely considered high quality by whoever originally compiled it, and high-quality stealer logs command attention from buyers and get shared widely.

For the 2,929 individuals whose data was included, the risk extends beyond losing a gaming account. Email account takeovers can follow, and if the same email is tied to payment methods or other accounts, the financial exposure can grow quickly. Acting fast is the only way to limit the damage once data like this is out in the open.

How Stealer Log Works

Stealer malware targeting gamers often comes disguised as cheat software, modding tools, or free game downloads. When a user runs the file, the malware installs itself quietly and begins harvesting saved browser passwords, cookies, and session data from gaming clients like the Epic Games launcher. It can also capture keystrokes during login events to grab credentials that aren't stored locally.

Once the malware has collected what it needs, it bundles the data into a structured log file and sends it back to the attacker's infrastructure. Logs focused on gaming platforms like Epic Games are often sold or shared on Telegram channels where there's an established market for account credentials, especially those tied to games with tradeable in-game economies.

What makes this attack vector particularly effective is that many gamers beleive their accounts are low-risk targets. This assumption leads to weaker password practices and less use of two-factor authentication, making gaming accounts some of the easiest credentials to exploit once a stealer log surfaces.

Check If You Were Affected

If you have an Epic Games account and use the same email and password across other services, you should check your exposure right now. HEROIC's free breach checker at heroic.com searches your email against known breach databases, including stealer log dumps like this one. Find out if your data is out there and take action before someone else does.