Dark Web Intel: 91,604 Credentials From the Butterfly Logs Dump

In June 2025, HEROIC threat intelligence analysts detected a massive stealer log collection labeled Butterfly Logs circulating on a public Telegram channel. Uploaded by an anonymous user, this dataset contained 91,604 compromised records, making it one of the larger stealer log dumps tracked by our team. The breach exposed email addresses, plaintext passwords, and associated login URLs harvested from infected devices primarily in the United States. The data was shared freely, giving any threat actor with access to the channel a ready-made toolkit for account compromise.

Why This Massive Credential Dump Is Dangerous

The sheer scale of the Butterfly Logs breach makes it exceptionally dangerous. With over 91,000 records containing plaintext passwords and the exact websites they belong to, attackers have an enormous pool of credentials to exploit. Each record is essentialy a key to someone's online account, and criminals can use automated tools to test these stolen logins across thousands of websites in minutes. The size of this dump also increases the liklihood that your credentials or those of someone you know may be included.

What Was Exposed in the Butterfly Logs Breach

• Email Addresses: Over 91,000 email addresses linked to personal and professional online accounts across a wide range of services
• Plaintext Passwords: Fully unencrypted passwords captured directly from victim browsers, ready for immediate use by attackers
• URLs: The specific login pages and websites tied to each stolen credential, providing attackers a precise map to victim accounts

Why This Matters for Digital Security

A credential dump of this size fuels large-scale credential stuffing campaigns, where attackers systematically test stolen email-and-password pairs against banking platforms, email providers, social media networks, cloud storage services, and corporate portals. Because password reuse remains extremly common, a single compromised credential from Butterfly Logs could give an attacker access to a victim's bank account, personal email, work systems, and more. The downstream consequences include identity theft, financial fraud, corporate data breaches, and unauthorized access to sensitive personal information.

How Stealer Log Operations Work on Telegram

Stealer logs like Butterfly Logs are created by information-stealing malware that silently infects a victim's computer or mobile device. This malware, often distributed through phishing emails, fake software installers, or malicious ads, captures everything stored in the victim's web browser. This includes saved passwords, autofill data, session cookies, and browsing history. The malware packages this stolen data into structured log files and sends them to a command-and-control server. Threat actors then compile thousands of individual log files into large collections and distribute them through Telegram channels and dark web forums. Telegram has become a preferred distribution platform because of its ease of use and large audience of buyers and traders in the underground economy.

Check If Your Credentials Were Exposed in Butterfly Logs

HEROIC's threat intelligence team continuously monitors Telegram channels, dark web marketplaces, and underground forums for credential dumps like Butterfly Logs. Our free breach scanner lets you check your email address against a database of over 400 billion compromised records. If your information was found in this breach or any other data leak, HEROIC will alert you so you can take immediate steps to change your passwords, enable two-factor authentication, and protect your accounts from takeover.