Amazon Shoppers Beware: Telegram Stealer Log Dumped 2,297 Accounts

HEROIC analysts identified a stealer log file uploaded by a Telegram user in August 2023 that exposed 2,297 Amazon-related account records. The dataset includes email addresses, plaintext passwords, and URLs tied to Amazon endpoints, meaning the compromised credentials could grant direct access to Amazon shopping accounts, Amazon Web Services consoles, and other Amazon-connected services. The file was shared openly on Telegram, where it could be downloaded by anyone with access to the channel.

Why This Is Dangerous

Amazon accounts hold an unusual concentration of sensitive information: saved credit card numbers, home delivery addresses, purchase histories, and in many cases access to Amazon Web Services accounts with cloud infrastructure. A working set of Amazon credentials gives an attacker a direct path to fraudulent purchases charged to saved payment methods, account lockouts, and access to any connected services using the same email and password. Because this log contains plaintext passwords, no additional effort is required to exploit the stolen data.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• Amazon URLs and Endpoint Data

Why This Matters

Amazon account breaches carry a higher-than-average financial risk because payment details are typically stored and ready to use. Attackers who gain access can place orders for gift cards or high-value items, change account details to lock out the real owner, and exploit saved one-click purchasing. For business users, an exposed Amazon Web Services login can lead to unauthorized cloud infrastructure usage, data theft, and significant financial liability. Credential stuffing also means the same email and password pair may be tested against banks, email providers, and social media platforms simultaneously.

How Stealer Logs Work

Stealer logs originate from malicious software called information stealers, which are installed on victims' devices without their knowledge. These programs scan browsers for saved passwords, authentication cookies, and stored credentials, then bundle everything into a structured log file. That file is transmitted back to the attacker and later packaged by category, often sorted by the type of service targeted, such as Amazon accounts. These categorized logs are sold on criminal marketplaces or, as in this case, distributed freely on Telegram channels to give other bad actors ready-to-use credentials.

Check If You Are Affected

If you have an Amazon account and are concerned your credentials may have been captured by a stealer, you can check your email address right now using HEROIC's free breach scanner. HEROIC's database contains over 400 billion compromised records sourced from thousands of breaches and stealer log collections. Finding out early gives you the chance to change your password and review your account before any fraudulent activity occurs.