berserklogs Stealer Log: 2,388 Real People’s Logins Are Compromised

We noticed the emergence of a stealer log file on a public Telegram channel on May 14, 2022, containing approximately 2388 records. What struck us was the direct exposure of plaintext passwords alongside email addresses and associated API host URLs. This type of data, often harvested through malware, presents a significant risk for credential stuffing attacks and unauthorized access to other services where users may have reused credentials. The relatively small scale of this particular leak, while concerning, suggests a targeted or opportunistic campaign rather than a broad data exfiltration event.

The breach, identified as originating from a stealer log uploaded by a Telegram user, involved 2388 individual records. The exposed data types include email addresses, plaintext passwords, and URLs, specifically API host URLs. This indicates that the compromised endpoints were likely interacting with specific services or APIs, and the associated credentials were captured. The source structure points to a malware-based compromise, where a stealer trojan on user endpoints collected and exfiltrated this sensitive information. The leak location on a public Telegram channel amplifies the immediate risk, as this data is readily accessible to malicious actors.

While this specific incident involving "berserklogs" and 448 logs uploaded by a Telegram user is not widely reported in major cybersecurity news outlets, the methodology aligns with common threat actor tactics. The use of Telegram channels for distributing stolen credentials and logs is a well-documented OSINT trend, often serving as a marketplace or distribution hub for compromised data. Research from various cybersecurity firms consistently highlights the prevalence of infostealer malware as a primary vector for harvesting credentials, underscoring the persistent threat posed by such attacks.