The alu.uct.cl Stealer Log Exposed 779 U.S.-Linked Accounts

HEROIC analysts found a stealer log tied to alu.uct.cl that a Telegram user uploaded on 10 June 2026. The file contains 779 records tied to United States accounts, including email addresses, plaintext passwords, and the URLs of the login pages those credentials belong to.

Why This Is Dangerous

This data was not pulled from an old database leak. Stealer logs come straight from an infected device, so the passwords inside are often the ones victims are still using today. Since they are stored in plaintext, an attacker can read and reuse a stolen email, password, and matching URL immediately, with no cracking required.

What Was Exposed in the alu.uct.cl Stealer Log

• Email addresses
• Plaintext passwords
• URLs of the accounts and login pages accessed

Why This Matters

Even a small dataset like this one carries real risk. If any of these 779 credentials were reused across other accounts, attackers can run them through banking, email, or shopping sites in a process called credential stuffing. A single successful match can lead to account takeover, unauthorized charges, or identity theft.

How a Stealer Log Like This Gets Created

Stealer logs come from malware installed through a fake download, a cracked program, or a malicious email attachment. Once running, it pulls saved passwords and autofill data directly from the browser and reports back exactly which sites the victim logged into. That is the same structure found in this alu.uct.cl dataset.

Check If You Are Affected

HEROIC's free breach scanner checks your email against a database of more than 400 billion compromised records, including stealer logs like this one. Run a scan now, and if you find a match, change that password everywhere else you have used it.