AuroraTeamSupport Leak Exposes 9,897 Plaintext Passwords

HEROIC analysts identified a stealer log file called AuroraTeamSupport 571count, uploaded to a public Telegram channel on November 19, 2025. The file contained 9,897 exposed records, including email addresses, plaintext passwords, and the URLs of the accounts those credentials belong to, all harvested directly from infected devices.

Why This Is Dangerous

Plaintext means no cracking, no decrypting, no delay. The passwords in this file are matched to the exact login URL, so anyone who downloads it can start using them immediately.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the associated login pages and accounts

Why This Matters

Reused passwords open the door to credential stuffing attacks and account takeover. Paired email addresses make identity theft and financial fraud easier for attackers who obtain this file.

How Stealer Log Breaches Happen

Infostealer malware infects a device through a phishing link, cracked software, or a fake installer, then scans the browser for saved logins and packages them into a log tied to that machine. Criminals collect thousands of these logs and sell or upload them in bulk, which is how AuroraTeamSupport 571count reached the public.

Check If You Are Affected

HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records in seconds. Check now and change any exposed passwords.