The SQWONKERLOGS10 Leak Exposed 6,013 US Email and Password Pairs

SQWONKERLOGS10 Stealer Log: 6,013 US Records Exposed

HEROIC analysts identified a stealer log uploaded to a public Telegram channel, dated December 13, 2022, labeled "SQWONKERLOGS10." The dataset contains 6,013 records tied to users in the United States, each pairing an email address with a plaintext password and the API host URL the credential was used to access.

Why This Is Dangerous

Because the passwords in this log were captured and leaked in plaintext, no cracking or decryption is needed to use them. Anyone who downloads the file can read every password exactly as it was typed, then combine it with the matching email address and URL to attempt a direct login on the affected service.

What Was Exposed

• Email addresses
• Plaintext passwords
• API host URLs tied to each credential pair

Why This Matters

Email and plaintext password pairs are the building blocks of credential stuffing, where attackers run stolen logins against banking, email, and shopping sites at scale. Because every account in this log is tied to a US-based user, the credentials are especially useful for attackers targeting American financial institutions and services where password reuse is common.

How Stealer Logs Work

A stealer log is the output of infostealer malware that infects a device, often through a fake download, cracked software, or a phishing link, and then quietly harvests saved browser passwords, autofill data, and session details. That data is sent back to the attacker, who often shares or sells it through channels like Telegram, exactly where HEROIC analysts found this dataset.

Check If You Are Affected

If your email address might be part of the SQWONKERLOGS10 stealer log or any other breach, HEROIC's free breach scanner checks it against a database of more than 400 billion exposed records. Run a scan now, and if your information turns up, change the affected password immediately along with anywhere else you may have reused it.