363 Verified U.S. Passwords Were Just Dumped on Telegram

HEROIC discovered a stealer log file titled USA Valids, uploaded to Telegram in February 2025, containing 363 compromised credential records. The label "Valids" is significant in underground markets — it indicates these credentials have already been tested and confirmed as working, making them far more dangerous than unverified dumps and immediately actionable for attackers.

Pre-Verified Plaintext Passwords Are the Highest Threat

Not only are these passwords stored in plaintext, but they have been verified as active. This eliminates the trial-and-error process that attackers typically face with raw credential dumps. Each of the 363 entries is a confirmed working login — an attacker can use any of them with a high degree of confidence that the account is accessible right now.

What Was Exposed

• Email Addresses — verified U.S.-based email accounts confirmed as active and accessible
• Plaintext Passwords — working passwords that have been tested and validated by threat actors
• URLs — the websites where each credential was confirmed to grant access

Verified Credentials Supercharge Credential Stuffing

Standard credential stuffing relies on volume — testing millions of credentials hoping for a small percentage to work. But with a pre-verified list like USA Valids, attackers skip that step entirely. They know these credentials work, so they focus on expanding the attack: testing each verified email-and-password pair against banking, shopping, cloud storage, and social media platforms. If you reuse the same password across services, every one of those accounts is now compromised.

The Lifecycle of Verified Stealer Log Data

Stealer logs start with infostealer malware that infects devices through malicious downloads, phishing links, or compromised software. The malware captures credentials from browsers, keystrokes, and session cookies. What makes collections labeled "Valids" different is an additional processing step: threat actors run the stolen credentials through automated validation tools that test each pair against the associated website. Only credentials that successfully log in are kept and packaged as "Valids" — a premium product in underground markets.

Check If Your Credentials Were Exposed

The USA Valids collection is now indexed in the HEROIC data breach scanner. With over 400 billion records in its database, HEROIC can instantly check whether your email or password appears in this or any other known breach. Because these credentials are pre-verified, the urgency to act is even greater. Search now, change your passwords immediately, and enable two-factor authentication to shut down unauthorized access before it happens.