Alert: 2,365-Record TOR_LOG MIX 162logs Leak Exposes Credentials

TOR_LOG Opens a Two-Day Release Window With 162 Files on October 20, 2023

TOR_LOG MIX 162logs is the first of two consecutive-day releases from the TOR_LOG operator in October 2023. Released on October 20, this batch contains 2,365 US credentials across 162 files -- a modest opening compared to what would follow the next day. On October 21, TOR_LOG released a second MIX batch with 247 files and 9,117 records at ~36.9 rec/file. The October 20 release's ~14.6 rec/file yield is substantially lower, which is consistent with a pattern seen across this cluster: operators releasing lower-quality inventory first and saving better-performing logs for the larger follow-up drop. The two-day TOR_LOG pattern mirrors what Monster Cloud and CRYPTON_LOGS were doing on the same October 20-21 window.

TOR_LOG MIX 162logs (October 2023): Stealer Log Summary

• Records Exposed: 2,365
• Data Types: Email addresses, plaintext passwords, URLs
• Breach Type: Stealer log -- credentials harvested from malware-infected endpoints, not a direct database breach
• Password Type: Plaintext -- captured directly from browser sessions and credential stores by infostealer malware
• Country: United States
• Date Leaked: October 20, 2023

Why Low Yield Doesn't Mean Low Risk

At ~14.6 records per file, TOR_LOG MIX 162logs has the lowest per-file yield of any TOR_LOG release in the October 2023 cluster. But yield is a property of the harvest -- the risk to victims is independent of it. Each of the 2,365 records in this batch contains a US email address, a plaintext password captured by infostealer malware from a real person's device, and the URL of the service where that password was active. A low-yield file simply means the compomised machine had fewer saved browser credentials -- not that those credentials are less valid or less useful to an attacker. Every record in a low-yield batch is just as exploitable as one from a high-yield batch.

The MIX Designation Across TOR_LOG Releases

Both the October 20 (162logs) and October 21 (247pcs) TOR_LOG releases carry the "MIX" content type designation. In stealer log parlance, MIX means the batch is not filtered by industry, geography within the country, or service type. The full range of endpoint targets is present -- from personal Gmail accounts to corporate Outlook logins, from banking portals to streaming services -- without the curation that would allow a buyer to acquire, say, only finance-sector credentials. MIX batches are the stealer log market's equivalent of a general-admission ticket: accessible, broad, and useful for spray-and-pray credential stuffing rather than targeted account takeovers.

TOR_LOG in Context: Part of the October 20 Multi-Operator Cluster

TOR_LOG MIX 162logs was one of at least ten stealer log releases on October 20, 2023. Alongside it came prdscloud 1214logs (40,336 records), 10.21 LOGS_CENTER (25,478), SNATCH_CLOUD 300PCS FREE (10,809), HUBHEAD_LOGS 300PCS FREE (5,724), STAKE_LOGS (4,165), CRYPTON_LOGS 2.0 (3,505), ANDRIANA CLOUDFREE LOGS (3,365), SMOKERCLOUD FREE LOGS (2,291), and OTTOMANGIFT 107PCS (70). The TOR_LOG batch was among the smaller contributors to October 20's total, but its operator would more than quadruple their output the following day -- demonstrating that small first-day releases often underrepresent an operator's true inventory depth.

Check If Your Data Was Exposed

HEROIC's free breach scanner covers more than 400 billion exposed records, including both TOR_LOG MIX releases from October 20-21, 2023 and the surrounding multi-operator cluster. If your email and credentials appear in this batch or any related releases from this period, HEROIC can identify the exposure. Run a free check now at HEROIC's breach scanner.