5,563 berserklogs Stealer Log Records Include Your Plaintext Password

We noticed a recent upload to a public Telegram channel containing a stealer log file, dated April 2022. The dataset, identified as "berserklogs – 423 LOGS," appears to originate from a malware infection rather than a direct compromise of a corporate network. What struck us was the inclusion of plaintext passwords alongside email addresses and API host URLs, indicating a significant risk of credential stuffing and further account takeovers for affected users. The relatively small pwned count of 5563 records suggests a targeted or limited scope of infection, but the nature of the exposed data warrants immediate attention.

The breach, discovered on May 4th, 2022, stems from a stealer log file uploaded by an anonymous Telegram user. This log contains 5563 records, each detailing an endpoint, an associated email address, an API host URL, and critically, a plaintext password. The source structure indicates a malware-based exfiltration, likely from compromised user devices rather than a direct breach of a central server. The primary threat theme here is credential compromise, with the exposed email addresses and plaintext passwords creating a high probability of unauthorized access to other services through credential reuse. The API host URLs could potentially reveal further infrastructure details or services targeted by the malware.

While this specific incident may not have garnered widespread news coverage due to its nature as a stealer log, the broader trend of malware-driven credential theft is a persistent concern. Research from cybersecurity firms frequently highlights the prevalence of information-stealing malware on consumer and enterprise endpoints, often distributed through phishing or malicious downloads. The exposure of plaintext passwords, as seen in this "berserklogs" dataset, directly aligns with findings that many users continue to employ weak or reused credentials, making them vulnerable to such attacks. The leak locations are primarily within the stealer log file itself, accessible via the Telegram channel where it was uploaded.