HEROIC Researchers Link the CB Dump to 5,796 Stolen Credentials

HEROIC researchers identified a stealer log referred to as CB uploaded to a public Telegram channel on December 24, 2022. The file exposed 5,796 records, each pairing an email address with a plaintext password and the URL of the login it belongs to.

Why Researchers Are Flagging the CB Stealer Log

What makes this file worth flagging is not just the volume but the format. Researchers found the passwords stored in plaintext, which means the credentials can be used the moment someone downloads the file, without any cracking or decryption. Paired with the URL each password unlocks, that data is ready to use for account takeover on sight.

What Was Exposed in the CB Stealer Log

• Email addresses
• Plaintext passwords
• URLs tied to each login

Why This Matters for the 5,796 People Affected

Anyone in this dataset who reused a password on other accounts is exposed well beyond the login named in the file. Attackers routinely take stolen credentials like these and run them against banks, email providers, and shopping sites through credential stuffing, which can lead directly to account takeover, identity theft, and financial fraud.

How a Stealer Log Like CB Gets Made

Stealer malware infects a device and quietly collects saved browser passwords, autofill data, and visited URLs, then sends everything back to whoever controls the malware. That data is packaged into a log file and often shared for free on Telegram, exactly how the CB data reached public view. Because it comes straight from an active device, the credentials tend to still work at the time of exposure.

Check If You Are Affected by This Leak

If you want to know whether your email or passwords appear in the CB leak or any other breach, HEROIC's free breach scanner checks your information against a database of more than 400 billion leaked records in seconds.