957 Plaintext Passwords Leaked in LogsDiller Stealer Log

On December 9th, 2025, HEROIC analysts identified a stealer log named "LogsDiller Cloud_211_26" uploaded to a public Telegram channel. The file contained 957 records pairing email addresses with plaintext passwords and the URLs each login was captured from, credentials taken directly from devices infected with information-stealing malware.

Why This Is Dangerous

These passwords are not hashed or encrypted in any way. They sit in the file exactly as the victim typed them, matched to the precise site each one unlocks. That means an attacker can attempt to log in immediately, with no cracking or guesswork required.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs (the login pages or API hosts tied to each credential)

Why This Matters

A relatively small record count does not mean a small risk. Because so many people reuse passwords, attackers run these plaintext email and password pairs through automated credential stuffing tools against banking, email, and shopping accounts, which can lead directly to account takeover, identity theft, and financial fraud.

How Stealer Log Breaches Work

Infostealer malware infects a device, often through a malicious download or cracked software, and silently copies every password, cookie, and autofill entry saved in the browser. That stolen data is bundled into a log and distributed through Telegram channels and dark web forums, the exact route this LogsDiller file traveled before HEROIC identified it.

Check If You Are Affected

HEROIC's free breach scanner checks your email against more than 400 billion breached records, including this LogsDiller stealer log. Run a free scan now to see if your credentials were exposed.