Our Analysts Found the Amazon 6 Stealer Log Circulating in Telegram Channels

HEROIC analysts discovered the Amazon 6 stealer log circulating in Telegram channels in August 2023, where a threat actor had uploaded the file for distribution among other criminals. The log contained 5,768 records, each one representing a real device that had been infected with information-stealing malware. The data captured included email addresses, plaintext passwords, and the URLs of the sites where those credentials belonged, making every entry immediately usable by anyone who downloaded the file.

Why This Is Dangerous

Amazon is not just a shopping platform. For millions of people, an Amazon account is linked to a debit or credit card, a home address, a history of purchases, and potentially an AWS account or business profile. When attackers get hold of a stealer log that targets Amazon credentials, they do not need to phish anyone or crack any hashes. The email, the password, and the target URL are all right there. That is everything needed to attempt a login immediately, before the victim has any idea their device was ever compromised.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs (the specific sites where credentials were captured)

Why This Matters

The combination of email addresses, plaintext passwords, and matching URLs is one of the most dangerous data packages in the cybercriminal world. Attackers use this data for credential stuffing: feeding the stolen pairs into automated tools that try the same login combinations across hundreds of websites. Because password reuse is extremely common, a single entry in this dataset can unlock accounts on email platforms, banking apps, social media, and more. The downstream risks include account takeover, financial fraud, and identity theft, all of which can unfold quickly once credentials are in the wrong hands.

How Stealer Logs Work

Stealer logs are produced by a category of malware specifically designed to harvest credentials from infected computers. The infection usually begins with a malicious email attachment, a fake software update, or a pirated program that contains a hidden payload. Once installed, the malware runs quietly and collects saved login data from browsers, including the website URLs, usernames, and passwords stored in the browser's autofill system. This data is then sent to the attacker or packaged into a log file and uploaded to a sharing platform like Telegram. The entire process can happen without any visible sign on the infected device.

Check If You Are Affected

If you are concerned that your Amazon login or any other credentials may have been captured in the Amazon 6 stealer log or a similar breach, HEROIC's free breach scanner checks your email address against over 400 billion records from known data breaches and stealer logs. It takes only seconds to find out, and acting early can protect you from account takeover and financial loss. Run your free scan at HEROIC now.