CRYPTON_TXT Breach: 1.4 Million Passwords Leaked Online

In October 2025, HEROIC analysts identified a stealer log file uploaded to a Telegram channel by a threat actor tracked as CRYPTON_TXT. The file, dated 17-Oct-2025, contained 1,443,652 records pulled directly from infected devices, including email addresses, plaintext passwords, and the URLs of the websites those credentials unlock.

Why This Stealer Log Is Dangerous

Unlike a typical company data breach, a stealer log comes straight from a victim's own computer. Malware silently copied saved logins from browsers and apps, then bundled them with the exact web address each password belongs to. That means an attacker does not have to guess where your email and password combination works. They already know.

What Was Exposed

• Email addresses
• Plaintext passwords (not hashed or encrypted)
• URLs linked to each set of stolen credentials

Why This Matters

Because these passwords were stored in plaintext, no cracking is needed. Criminals can plug them directly into the matching URLs and log in immediately. This makes the data incredibly useful for credential stuffing, account takeover, and identity theft. If any of these logins are reused elsewhere, financial fraud often follows within days.

How Stealer Logs Work

Stealer malware infects a device through a fake download, cracked software, or a maliscious email attachment. Once installed, it quietly harvests saved passwords, cookies, and autofill data from browsers, then uploads everything to a remote server. Threat actors package these logs and sell or leak them on Telegram and dark web forums, often within weeks of infection.

Check If You Are Affected

With over 400 billion leaked records already indexed, HEROIC's free breach scanner can tell you in seconds if your email or passwords appeared in this or any other incident. It is a quick way to catch a compromised account before someone else finds it first.