What Attackers Can Do With the Corps 05.09 Leak of 30,967 Logins

What Attackers Can Do With the "Corps 05.09" Stealer Log

HEROIC analysts identified a stealer log named "Corps 05.09" that was uploaded to Telegram on March 9, 2023. The file contains 30,967 records, each one pairing an email address with a plaintext password and the URL of the site the login was captured from. The name suggests the uploader may have targeted or filtered credentials associated with corporate accounts, which can carry more value to attackers than personal logins alone.

Why This Is Dangerous

With plaintext passwords for 30,967 accounts, an attacker can immediately attempt to log into whatever email, portal, or internal tool each record is tied to, no cracking required. If any of these credentials belong to business email accounts, an attacker could use them to access internal communications, impersonate an employee, or pivot toward more valuable systems inside an organization's network. Even without a corporate angle, each record still functions as a complete, working login.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs and endpoints tied to each login

Why This Matters

An attacker with a working email and password combination can attempt credential stuffing against other accounts owned by the same person, from banking to social media. If a corporate account is compromised, the consequences can extend beyond one individual, potentially exposing coworkers, clients, or company data to further attacks. Reused passwords are what turn a single leaked credential into a much wider security incident.

How Stealer Logs Work

Stealer malware typically infects a device through pirated software, cracked applications, or malicious email attachments, then quietly extracts saved passwords and autofill data from the browser. That stolen information is compiled into a log file and delivered to the attacker, often automatically through a Telegram bot. Logs labeled around a theme like "Corps" suggest the uploader curated the file specifically to appeal to buyers interested in business or organizational access.

Check If You Are Affected

Whether your accounts are personal or work-related, it is worth confirming they were not part of this leak. HEROIC's free breach scanner searches a database of more than 400 billion leaked records, including stealer logs like this one, so you can quickly check your exposure and secure any at-risk credentials.