The 89 Boss2 Telegram Dump Contains Exactly 4,915 Email and Password Pairs

In August 2023, HEROIC analysts confirmed a stealer log file uploaded to Telegram by a user identified as "89 Boss2" that exposed exactly 4,915 records. Each record contains an email address, a plaintext password, and a URL, data captured directly from infected computers and distributed through Telegram for other cybercriminals to exploit. This log is part of a broader wave of infostealer campaigns that quietly harvest credentials from everyday users without triggering any visible warning signs.

Why This Is Dangerous

Unlike breaches where passwords are stored in encrypted form, the passwords in this file require no cracking or technical effort to use. They are ready to use immediately. Anyone who obtained this file can attempt to log into email accounts, online banking portals, workplace systems, and social media platforms using the exact credentials captured from victims' devices. The accompanying URLs tell attackers precisely which services the victim was using, eliminating guesswork and making attacks faster and more targeted.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs (the specific web addresses active at time of theft)

Why This Matters

With 4,915 complete credential sets available in a single file, attackers have an immediate list of targets to work through. Credential stuffing attacks, where stolen email and password pairs are tested automatically across hundreds of websites, can compromise dozens of additional accounts per victim in a matter of hours. Because password reuse is extremely common, a single stolen password can unlock accounts the victim had long forgotten about.

Access to email accounts is especially damaging. An attacker who controls someone's email can intercept password reset links, read private communications, impersonate the victim to contacts, and access any service linked to that address. Identity theft and financial fraud are common outcomes once email access is established.

How Stealer Logs Work

Infostealer malware is designed to run invisibly on a victim's computer. It typically arrives disguised as a legitimate file, such as a cracked software installer, a document attached to a phishing email, or a browser extension. Once installed, it scans for passwords saved in browsers like Chrome and Firefox, captures login credentials as they are typed into websites, and records the URLs of active sessions. All of this information is bundled into a log file and transmitted to the attacker's server.

The attacker, in this case identified by the handle "89 Boss2," then distributed the log through Telegram, a messaging platform widely used by cybercriminal communities to sell or freely share stolen data. The speed of this distribution means credentials can be actively exploited within days of being stolen.

Check If You Are Affected

HEROIC's free breach scanner checks your email address against more than 400 billion exposed records, including stealer log files like the one uploaded by 89 Boss2. If your credentials appear in this file or any other known breach, HEROIC will tell you what was exposed so you can change affected passwords and secure your accounts before an attacker gets there first.