The berserklogs Stealer log Gave Hackers 4,937 Working Passwords

We noticed a concerning influx of stealer log data surfacing on Telegram in late May 2022, specifically a file identified as "berserklogs- 305 LOGS MAY" uploaded by an anonymous user. What struck us immediately was the inclusion of plaintext passwords alongside email addresses and associated URLs, a configuration that significantly lowers the barrier to compromise for any credentials found within. The sheer volume, while not astronomical, is substantial enough to warrant immediate attention, especially given the direct exposure of sensitive authentication material.

The breach originated from a stealer log, a common artifact of malware designed to exfiltrate data from compromised endpoints. This particular log, uploaded on May 24, 2022, contained 4937 distinct records. Each record comprised an email address, a plaintext password, and an API host URL. The source structure indicates a direct capture of user input or browser credentials from infected machines. The implications are significant: any user whose credentials were logged and subsequently uploaded to this public Telegram channel is at immediate risk of account takeover across multiple services, particularly if they reuse passwords. The presence of API host URLs suggests potential exposure of credentials for services that leverage API authentication, which can have far-reaching consequences for integrated systems.

While this specific stealer log upload did not generate widespread mainstream news coverage, the broader phenomenon of credential stuffing and account compromise stemming from such leaks is a persistent concern. Security researchers and threat intelligence platforms frequently document the discovery and analysis of stealer logs circulating on illicit forums and messaging platforms. For instance, reports from cybersecurity firms like Mandiant and CrowdStrike regularly highlight the threat posed by malware families capable of harvesting these types of credentials, emphasizing the critical need for robust endpoint security and user education on credential hygiene.