Our Analysts Found the 428K USA Target Domain UHQ Dump on Telegram

HEROIC analysts discovered a stealer log file named 428K USA Target Domain UHQ circulating on Telegram, tied to an upload dated April 2023. The file contains 406,097 records taken directly from infected computers, including email addresses, plaintext passwords, and the URLs those credentials belong to.

Why This Is Dangerous

This data did not come from a hacked website. It came from malware that ran quietly on people's own computers, copying the passwords saved in their browsers. Because each password is paired with its exact website and stored in plain, readable text, an attacker can log in right away without needing to crack or decode anything.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs tied to each login

Why This Matters

With over 406,000 records in this single file, the exposure is large enough to fuel widespread automated attacks. Criminals feed stolen email and password pairs like these into scripts that test them against banking apps, email providers, and online stores, a method known as credential stuffing. Anyone who reused a password caught up in this leak is at real risk of account takeover, financial fraud, or identity theft.

How Stealer Logs Work

Stealer log malware spreads through pirated software, fake cracked programs, or malicious attachments disguised as something else. Once it runs on a device, it quietly copies saved passwords and autofill data out of the browser and compiles everything into a text file. That file, like this 428K USA Target Domain UHQ dump, is then traded or given away on Telegram channels and dark web forums, often labeled by the region or type of account it targets. Because the data comes directly from the browser, it tends to be accurate at the time it was captured.

Check If You Are Affected

If you want to know whether your email or passwords are part of this leak, HEROIC makes it simple to check. Our free breach scanner searches a database of more than 400 billion leaked records and tells you instantly if your information has been exposed. Run a free scan today and update any passwords you may have reused.