Android All-Passwords App Leak Exposes 9,840 Saved Logins

A file named 03.All-Passwords-Android.App appeared on Telegram in November 2025. It contains 9,840 records. Each one holds an email address, a plaintext password, and the URL where that password was saved on someone's phone.

Why This Is Dangerous

Password vault style apps store everything in one place, wich makes them a single point of failure. When a device gets infected and that vault is grabbed, an attacker doesnt just get one login, they get every account the phone owner ever saved. That is exactly what happened here, nearly ten thousand records in a single sweep.

What Was Exposed

The confirmed contents of the file include:

• Email Addresses
• Plaintext Passwords
• URLs tied to each saved login
• 9,840 total records exposed

Why This Matters

People often trust password saving apps to keep their information safe, so a leak from one of these tools can feel especialy unfair. If the app stored passwords in plaintext rather then encrypting them, anyone who gets ahold of the file can read every login instantly, no cracking or extra steps needed. That convenience for the user becomes a shortcut for the attacker too.

How Stealer Logs Work

Mobile stealer malware works much like its desktop counterpart. Once it lands on a phone, often through a sideloaded app or a malicious update, it searches for password managers, browsers, and other apps that store login data, then copies everything it finds. The stolen records get bundled into a file like this one and shared on channels where thousands of people can access them.

Check If You Are Affected

If you have ever stored passwords in an app on your Android device, it is worth checking your exposure today. HEROIC's free breach scanner covers more than 400 billion compromised records, so you can search your email and get a clear answer on whether your saved logins were part of this leak.