AR181.4.189.152 Telegram Stealer Log Exposes 115 Records Now

HEROIC analysts identified a stealer log tied to the Argentine endpoint AR181.4.189.152 that was uploaded to a public Telegram channel in March 2025. The log exposed 115 records containing email addresses, plaintext passwords, and URLs -- all harvested directly from infected machines. This type of leak is imediately actionable for attackers, requiring no further cracking or decoding before abuse begins.

Why This Is Dangerous

Stealer logs compiled from a single compromised endpoint like AR181.4.189.152 give attackers ready-to-use credential pairs tied to real websites. Because the passwords are in plaintext, anyone who downloads the file from Telegram can start attempting logins within minutes across email, banking, and social media platforms. The exposed URLs also reveal exactly which services the victom was logged into at the time of infection.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs (login pages and API endpoints)

Why This Matters

When passwords are stored in plaintext and paired with the exact URLs where they were used, the attack path is straight-forward. Threat actors can attempt credential stuffing across every service tied to those email addresses. A single compromised account can lead to account takeover, identity theft, unauthorized financial transactions, and further phishing attacks against that persons contacts. Because stealer logs circulate freely on Telegram, the window between exposure and exploitation is extremely short.

How Stealer Logs Work

Infostealer malware quietly installs itself on a victims computer, often through a malicious download, cracked software, or a phishing link. Once running, it harvests saved browser credentials, session cookies, and autofill data before packaging everything into a log file and sending it back to the attacker. That log is then shared or sold on Telegram channels and dark web forums. The endpoint IP address -- in this case AR181.4.189.152 -- is logged as the source, helping researchers trace the geographic origin of the infection back to Argentina.

Check If You Are Affected

HEROIC's free breach scanner searches across more than 400 billion exposed records to tell you if your email or password appeared in this leak or any other known breach. If your credentials were included in this Telegram stealer log, you need to know now -- before an attacker uses them against you.

Run a free scan at HEROIC.com and find out if your data was exposed.