4,601 Stolen Logins From the 98_Boss Stealer Log Surface Online

In July 2026, HEROIC analysts identified a stealer log labeled "98_Boss" uploaded to a Telegram channel. The file contained 4,601 records harvested by malware from infected devices, including endpoints, email addresses, API hosts, and plaintext passwords. Why the 98_Boss Stealer Log Is Dangerous: unlike data pulled from a hacked website, stealer log entries come straight from an infected computer, capturing whatever was saved in the browser at the time of infection. That means the 4,601 credentials in this file are likely to still be active, giving attackers a working set of logins rather than outdated ones. What Was Exposed: email addresses, plaintext passwords, and the URLs and API hosts tied to each login. Why This Matters: because stealer logs reflect real, recently used credentials, they are a favorite tool for account takeover and credential stuffing. Someone whose information appears in the 98_Boss log could find their email, banking, or shopping accounts accessed by someone else, often without any obvious sign until money or data is already gone. How a Stealer Log Works: stealer malware infects a device through a malicious download, cracked software, or phishing link, then silently collects saved passwords, autofill details, and browser sessions before sending them back to the attacker in a text file. That is exactly how the 98_Boss log was built, compiling 4,601 sets of endpoints, emails, and passwords from infected machines into one shareable file. Check If You Are Affected: HEROIC's free breach scanner checks your email against more than 400 billion leaked records, including stealer logs like 98_Boss. Check your exposure now to see if your saved logins have been compromised.