147 Bank of America Logins Found in a Telegram Stealer Log

In May 2026, a stealer log file uploaded to a Telegram channel was found to contain 147 sets of login credentials tied to Bank of America's online banking pages. Each entry paired an email address with a plaintext password and the exact web address where the login was typed in. It is important to be clear about what this is and what it is not. This is not a breach of Bank of America's own systems. It is a stealer log, a batch of credentials harvested by malware running on the personal devices of 147 people who happened to use Bank of America online, then packaged together and shared on Telegram.

How These 147 Credentials Were Discovered

Stealer logs like this one surface constantly on Telegram channels dedicated to trading stolen data. This particular file stood out because every entry pointed to the same login destination, Bank of America's sign-in page, suggesting the victims were flagged or grouped together specifically because of the bank they used. The file was uploaded by an anonymous Telegram user and made available to anyone in the channel, which is how it came to light.

What Was Exposed

• Email addresses used to log in to Bank of America online banking
• Plaintext passwords for each of the 147 accounts, stored with no encryption
• The specific login page URL tied to each credential pair

Why This Matters

A working email and password for an online banking account is one of the most valuable things a criminal can get their hands on. With it, an attacker can attempt to log in directly, redirect statements, or use the credentials as a starting point for account takeover and financial fraud. If any of these 147 people reused their banking password on another site, that account is exposed too, and the reverse is also true: a password stolen from a smaller, less protected site can end up being the same one used to log in to a bank.

How Bank of America Stealer Log Credentials Get Captured

None of this comes from a hack of Bank of America's servers. It starts with infostealer malware infecting a victim's own computer, usually through a fake download, a cracked application, or a malicious attachment. Once installed, the malware reads whatever the browser has saved, including autofill passwords and login sessions, and quietly sends it back to the attacker. Because Bank of America's login page was one of the sites open or saved on these infected devices, its web address and the matching password ended up in the stolen file.

Check If You Are Affected

If you bank online, it is worth checking whether your credentials show up in this leak or any other. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked and stolen records, including stealer logs like this one. Run a free scan now and change any password that comes back exposed.