‘537K Brazilian Userpass’ Dump Leaks 521,689 Telegram Logins

In April 2023, a Telegram user uploaded a stealer log dump labeled "537K Private Brazilian Userpass," a collection of 521,689 login records pulled from malware-infected devices. The file's own label identifies the accounts as belonging to Brazilian users, and like other stealer logs, it was never a breach of one company's servers. Instead it is raw credential data harvested from individual computers and repackaged for sale and trade on Telegram.

Why This Brazilian Userpass Dump Is Dangerous

The 521,689 records in this file were captured in plaintext, meaning every password sits in readable form with no encryption standing between it and whoever opens the file. Each entry also pairs an email address with the URL of the site it unlocks, so the dump works less like a list of leaked passwords and more like a set of ready-made keys, sorted by which door they open.

What Was Exposed in the "537K Private Brazilian Userpass" Dump

• Email addresses
• Plaintext passwords
• URLs (the sites each login pairs with)

Why This Matters for the Accounts Involved

Because the passwords are stored in plain text and matched to specific site URLs, criminals can automate credential stuffing attacks against banking, email, and shopping accounts with almost no extra effort. Anyone who reused one of these passwords elsewhere is exposed to account takeover, identity theft, and financial fraud the moment someone decides to use the file.

How a Stealer Log Dump Like This Gets Made

Infostealer malware usually spreads through pirated software, fake browser updates, or malicious attachments. Once it infects a device, it quietly collects saved passwords, autofill entries, and site URLs from the browser and sends them back to whoever controls the malware. Large batches like "537K Private Brazilian Userpass" are the packaged output of that process, uploaded to Telegram channels where they are sold, traded, or used directly against victims.

Check If You Are Affected

If any of your accounts were caught up in this Telegram stealer log dump, reused passwords elsewhere are now at risk too. HEROIC's free breach scanner checks your email against more than 400 billion leaked records, including stealer logs like this one, so you can quickly find out if your information was exposed and change your passwords before someone else uses them.