Our Analysts Found the BananaLogs 82count Dump Circulating on Telegram

While monitoring Telegram channels that are known to distribute stolen credential files, HEROIC analysts spotted the BananaLogs 82count dump on October 22, 2023. What made this file stand out was not just the volume of records but the specificity of the data inside. The 3,489 records included not only email addresses and plaintext passwords but also internal API hostnames and endpoint URLs. That combination suggests that at least some of the infected devices belonged to people working in technical roles, giving the stolen data a higher potential impact than a typical consumer credential dump. The name "BananaLogs 82count" likely references a collection or session identifier used by the attacker to organize their stolen log files.

Why This Is Dangerous

API credentials and internal endpoint URLs are not the kind of data that most people think about when they imagine a data breach. Most people picture usernames and passwords for websites. But when a stealer log captures API keys alongside email logins, it means an attacker might be able to access internal tools, databases, or business services directly. For individuals, the risk is the plaintext passwords being used in credential stuffing attacks across popular websites. For companies whose employees were affected, the risk is that internal systems could be at risk if those API credentials have not been rotated.

What Was Exposed

• Email addresses from infected devices
• Plaintext passwords stored without any hashing or encryption
• URLs showing which websites and services were in use
• Internal API hostnames and endpoint data
• 3,489 total records in the BananaLogs 82count dump

Why This Matters

Stealer log files like BananaLogs 82count are part of a growing ecosystem where malware operators, credential brokers, and account takeover specialists all work together. The attacker who collected these logs may have passed them to a second party who then shared them on Telegram to build credibility or attract buyers. Once a file is distributed freely on these channels, it can be downloaded and used by hundreds of different individuals, each running their own automated attacks. Even a relatively small dump of 3,489 records can fuel a significant wave of account compromise attempts if the affected users have not changed their passwords.

How Stealer Log Breaches Work

Infostealer malware typically arrives through phishing emails, fake software instalers, or malicious browser extensions. Once on a device, it scans for everything the browser has stored: saved passwords, autofill data, session cookies, and any credentials entered into web forms. It also captures the URLs of sites that were visited, which is why these logs often reveal what services a person was using. The entire harvest is packaged into a structured log file and sent back to the attacker automatically. The victim usually has no idea this has happened.

Check If You Are Affected

HEROIC's free breach scanner has indexed more than 400 billion leaked records, including stealer logs like BananaLogs 82count. Enter your email address to see whether your credentials appeared in this breach or any other known data leak. If your information shows up, update your passwords immediately, starting with your email account and any work-related logins.