Stolen From Infected Devices, the ATM_LOGS File Holds 4,324 Logins

HEROIC analysts found 4,324 records in the ATM_LOGS stealer log, dated 13-Aug-2024, pairing email addresses with plaintext passwords and the URLs those logins unlock. The only way to know if you're affected is to scan your email.

Why This File Needs No Cracking Effort

Because this file was copied straight from an infected device, the passwords inside are stored in plain text exactly as typed, ready to use without cracking. Two years is more than enough time for a file like this to have been copied, resold, and recirculated multiple times over.

What Was Exposed

• Email Addresses: identifies the account owner for phishing or impersonation.
• Plaintext Password: readable immediately, no cracking required.
• URLs: shows exactly which account each password belongs to.

Why Every Login From That Device Is Exposed

Any account logged into from the infected device behind this file could have a working, readable password sitting here, making takeover possible as soon as someone uses the file. If that password was never changed afterward, it may still work today.

How the ATM_LOGS File Was Likely Collected

Stealer logs like this one come from malware running quietly on a victim's own device, copying saved browser logins before sending them back to whoever controls the malware. No company's systems were involved, the compromise happened on the device itself.

Were Your Logins Captured in the ATM_LOGS File?

Scan your email to check.

If it appears, clean or reset the device first, then change your passwords only from a separate, clean device, since the stolen logins came from the device itself, not from any site you use.

This applies to personal and work email alike.