ATM_LOGS January 2025: 11,919 U.S. Credentials Dropped on Telegram

Nearly 12,000 U.S. Accounts in a Single January 2025 Telegram Drop

ATM_LOGS is a handle used by a recurring Telegram stealer log operation. On January 26, 2025, a file bearing this name surfaced on Telegram containing 11,919 U.S. credential records. HEROIC's DarkHive analysts pulled the file and confirmed the contents: email addresses, plaintext passwords, and the specific login URLs where each credential was captured by infostealer malware.

With nearly 12,000 records, this is a substancial dump by Telegram standards. At this volume, the file almost certainely contains credentials for banking portals, healthcare accounts, corporate email logins, and everyday services like streaming platforms and e-commerce sites. The attacker doesn't need to pick targets: the targets are already catalogued inside the file.

What ATM_LOGS January 2025 Contains

Every record in the file is structured for immediate use:

• Email Addresses: 11,919 U.S. accounts
• Plaintext Passwords: Full cleartext, no hashing
• Target URLs: Exact login pages tied to each credential pair

The January 2025 date puts this squarely in the window of active, live accounts. Unlike older dumps where victims may have eventually changed their passwords, a 2025 stealer log release represents credentials that were current at the time of capture. Many of those accounts are likely still accessible with the same password today.

How a File Like This Gets Built and Distributed

Infostealer malware infects devices through phishing emails, pirated software, and malicious browser extensions. Once installed, it silently harvests every saved browser credential and active session on the machine. The output is a log file that gets sent back to the operator's server. The ATM_LOGS operation aggregates these files across many infected machines, then packages and releases them to Telegram, where they're downloaded by anyone following the channel.

The name ATM_LOGS appears across multiple releases with different record counts, confirming this is an ongoing operation rather than a single event. Each batch represents another round of infected machines, another set of victims, another file uploaded for anyone to exploite.

HEROIC's Scanner Covers ATM_LOGS and Similar Operations

HEROIC's free breach scanner checks email addresses against more than 400 billion records, including ATM_LOGS and related Telegram stealer dumps. If your email appeared in this January 2025 file, you'll find out instantly. Given how recent this data is, checking now is especially worth doing.