Alert: 8,898-Record BananaLogs 633count Leak Exposes Logins

BananaLogs 633count: The Larger File-Count Batch From a Two-Release Day

BananaLogs released two distinct batches on October 18, 2023. The 499count batch (9,493 records, ~499 files) and the 633count batch (8,898 records, ~633 files) were released the same day from the same channel. Counter-intuitively, 633count has more files but fewer total records -- producing a lower per-file density of approximately 14.1 records per file compared to 499count's ~19.0. This reversal sugest that the two batches came from diferent underlying collection sources with diferent endpoint richness profiles. The 633count logs likely came from a wider sweep of lower-density machines, while 499count captured fewer but more credential-rich endpoints.

BananaLogs 633count (October 2023): Stealer Log Summary

• Records Exposed: 8,898
• Data Types: Email addresses, plaintext passwords, URLs
• Breach Type: Stealer log -- credentials harvested from malware-infected endpoints, not a direct database breach
• Password Type: Plaintext -- captured directly from browser sessions and credential stores by infostealer malware
• Country: United States
• Date Leaked: October 18, 2023

633 Files: The Endpoint Reach of BananaLogs' Larger Batch

At 633 individual log files, BananaLogs 633count represents at minimum 633 distinct US endpoints compromised by infostealer malware. Combined with the 499count batch, BananaLogs accounted for at least 1,132 individual US machines compromised and catalogued in a single day. The 633count file set is larger than the 499count set by 134 files, and its broader sweep reflects the multi-source aggregation model common among active Telegram stealer log channels: pulling logs from multiple collection campaigns and releasing them in batched sets labeled by file count for easy subscriber comparison.

BananaLogs in Context: 18,391 Combined Records on October 18

The two BananaLogs batches released October 18 -- 499count (9,493 records) and 633count (8,898 records) -- combine to 18,391 US plaintext credentials in a single day. That total places BananaLogs among the higher-volume single-operator contributors to the October 18 pre-cluster event, ahead of many individual operators though behind Monster Cloud's three confirmed Oct 18 batches. The fruit branding might be absurdist, but the output volume is consistant with a serious, high-capacity stealer log distibution operation.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion exposed records, including stealer log data from both BananaLogs batches released October 18, 2023. If your credentials appeared in the 633count batch or the 499count batch, a free scan at HEROIC's breach scanner can confirm whether your data is in the index.