311K+ Passwords: GHOST FREE 3 Stealer Dump

On October 17, 2025, the GHOST stealer campaign released 311,873 compromised credential records through Telegram as GHOST FREE 3. The dataset includes email addresses, plaintext passwords, system endpoint data, and authentication URLs harvested from infected Windows systems. This represents one of the largest single stealer dumps on record.

The Massive Scale
311,000 compromised records means hundreds of thousands of victims are exposed. The campaign has established significant market presence through consistent, high-volume releases. Your chances of being affected statistically increase substantially with a dump this large.

What Was Exposed

• 311,873 email addresses from diverse providers
• Plaintext passwords for immediate use
• System endpoints revealing computer networks
• API tokens and authentication URLs
• Cached credentials and browser sessions

Why This Matters

The breach is dangerouse because of scale. Over 300,000 credentials means attackers are conducting massive automated account takeover campaigns. They're testing credentials across major platforms and reseting passwords on linked accounts. The plaintext passwords make immediate exploitation trivial. Researchers estimate the attacker has harvested credentials from over 5 million machines.

How The Operation Works

GHOST operates one of the most sophisticated stealer malware networks. The malware is distributed through an affiliate network spanning multiple countries. GHOST maintains command-and-control infrastructure with redundancy to avoid takedowns. Harvested data is automatically processed, deduplicated, and sorted by profile for maximum resale value.

Check If You're Affected

Search for your email address in the databases below immediately. If found, assume passwords are in circulation among threat actors.