Acolyte Bases Leak: 3,690,696 Records Hit Telegram Channels

Acolyte Bases is back: the same Telegram uploader posted a second batch on 06-May-2026, this time containing 3,690,696 records. It is nearly as large as the first release and follows the same stealer log format HEROIC has come to recognize from this source.

Why This Is Dangerous

Seeing the same uploader release multiple multi million record batches in a matter of days suggests an ongoing, active operation rather than a one time incident. Each of these 3,690,696 records comes with a plaintext password and a matching URL, so attackers do not need to do any extra work before attempting to log in.

What Was Exposed

• 3,690,696 individual records
• Email Addresses
• Plaintext Password
• URLs linked to each login

Why This Matters

When the same source keeps producing fresh batches, it usually means the malware behind it is still spreading and infecting new devices every day. People who checked themselves against the first Acolyte Bases release and came back clean should not assume they are safe from this seperate second wave, since new victims get added with every update.

How Stealer Logs Work

Recurring releases like this typically come from a botnet of infected machines that continuously reports back to its operator. Rather than release everything at once, the operator batches the stolen credentials into rounds, wich is why researchers see numbered or dated versions of the same base name showing up again and again.

Check If You Are Affected

Because this operation is clearly still active, it is worth checking your exposure more than once. HEROIC's free breach scanner covers over 400 billion leaked records and updates as new dumps like this one are discovered, so you always have a current picture of your risk.