Small but Real: ‘crnh’ Stealer Log Leaks 95 Passwords Online

The "crnh" Stealer Log: Just 95 Records, Still a Real Risk

In July 2026, HEROIC analysts found a small stealer log labeled "crnh" on Telegram, containing 95 records made up of email addresses, plaintext passwords, and the login URLs tied to each account. It is a fraction of the size of some other logs circulating right now, but every one of those 95 records represents a real account.

Why This Is Dangerous

Size does not change how usable stolen data is. These 95 passwords are stored in plaintext, meaning anyone with the file can log directly into the associated accounts, no cracking required. A smaller log can even mean an attacker gives each record more individual attention.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated login URLs (the exact pages the credentials unlock)

Why This Matters

If any of these 95 individuals reused their password on another site, that single leaked credential can unlock email, banking, or social accounts elsewhere. Small logs like this one are exactly the kind of data attackers use for targeted credential stuffing or account takeover, precisely because they attract less attention than larger, headline making breaches.

How a Small Stealer Log Like This Gets Created

Not every stealer log comes from a mass malware campaign. Smaller files like "crnh" can result from a single infected device or a short-lived infection, with the malware exporting whatever saved browser credentials it found before the file is uploaded to Telegram, often as a sample to prove a bigger dataset exists.

Check If You Are Affected

A leak does not need to be large to matter to you personally. HEROIC's free breach scanner checks your email against more than 400 billion breached and leaked records, including small logs like this one, so you can confirm your exposure in seconds.