How a Telegram Upload Led to 4,785 Stolen Logins in ATM_LOGS

On 4 July 2024, a Telegram user uploaded a stealer log archive named "ATM_LOGS" that HEROIC analysts identified while monitoring channels that distribute malware-harvested data. The file contains 4,785 records made up of email addresses, plaintext passwords, and the URLs of the sites those logins were used on.

Why This Is Dangerous

Despite the name, the data inside this file consists of email and password pairs captured from infected devices, not physical bank card details. These credentials were active on the victims' machines at the time the malware ran, which means an attacker could try them immediately with a strong chance they still work.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the sites each set of credentials was used on

Why This Matters

Stealer logs like "ATM_LOGS" capture whatever a piece of malware found saved in a victim's browser, which can include email, banking, and shopping logins all from the same device. Anyone among the 4,785 exposed records is at risk of having several of their accounts targeted at once if they used the same browser to access them.

How Stealer Logs Work

A stealer log is generated by information-stealing malware that infects a computer, then quietly extracts saved passwords, autofill entries, and browsing history from installed web browsers before sending everything back to the attacker. Threat actors often give these logs branded names, like "ATM_LOGS," to make them sound more valuable or targeted when advertising them on Telegram, even when the actual contents are standard browser-saved credentials.

Check If You Are Affected

Run a free scan against HEROIC's database of more than 400 billion leaked records to check whether your email address appears in this stealer log, and change any passwords that may still be in use.