6,703 Passwords Exposed in New CryptogoL12 Telegram Leak

In July 2026, HEROIC analysts found a second stealer log file, "CryptogoL12 2," posted to a Telegram channel. This follow-up batch contains 6,703 records, each pairing an email address with a plaintext password and the login URL the credential was captured from.

Why This CryptogoL12 Follow-Up Leak Is Dangerous

The fact that a second CryptogoL12 batch has appeared suggests the same operator is continuing to harvest and release fresh data over time. Like the first release, this data was not stolen from a company database. It was pulled directly from infected computers by information-stealing malware, which quietly copies saved browser passwords before sending them to whoever runs the operation. Because each record already links a specific website to a working email and password, an attacker does not need to guess anything to log in.

What Was Exposed

• Email addresses
• Plaintext passwords
• Login URLs (the exact site each credential unlocks)

Why This Matters

Even at 6,703 records, this batch is fully usable for credential stuffing and account takeover, since the passwords are plaintext and already matched to their websites. Anyone in this smaller batch faces the same risk as a larger leak: unauthorized access to email, shopping, or financial accounts, particularly if a password has been reused elsewhere.

How Repeat Stealer Log Releases Like This Happen

Stealer logs come from ongoing malware infections rather than a single database hack. Victims get infected through cracked software, phishing links, or fake downloads, and the malware keeps collecting saved usernames, passwords, cookies, and autofill data as new victims are added. Operators often release these batches in numbered waves, such as this second CryptogoL12 file, as fresh data accumulates, sharing or selling it on Telegram channels and dark web forums.

Check If You Are Affected

With 6,703 credential pairs in this batch alone, checking your exposure takes only a moment. HEROIC's free breach scanner searches more than 400 billion leaked records, including stealer logs like this one, so you can quickly find out if your email or passwords have been exposed and secure your accounts before they are misused.