CuckooLogsPublic Leak: Plaintext Passwords From 18,144 Logs

CuckooLogsPublic-20250923: 18,144 Records From a Public Stealer Log Drop

HEROIC analysts flagged a stealer log file named "CuckooLogsPublic-20250923" that was uploaded to a Telegram channel on 23 September 2025. The file contained 18,144 records, each combining an email address, a plaintext password, and the URL of the login page the credential was captured from.

The word "Public" in the filename signals that this batch, unlike premium or paid logs, was released openly for anyone to download, making the exposure window especially wide since no purchase or vetting stood between the data and whoever wanted it.

Why This Is Dangerous

Every record in CuckooLogsPublic-20250923 hands an attacker a ready-made login: the email, the exact plaintext password, and the site it belongs to. There is no password to crack and no account to guess. Because the file was distributed publicly and for free, it likely reached a far wider pool of opportunistic attackers than a log sold privately would.

What Was Exposed in CuckooLogsPublic-20250923

• Email addresses
• Plaintext passwords
• URLs of the associated login pages

Why This Matters

With 18,144 working logins in circulation, this file is an ideal source for credential stuffing, where bots automatically try the same email and password pair against banking, email, and shopping sites. Because so many people reuse passwords, a single credential from this leak can quickly turn into account takeover, identity theft, or direct financial fraud on services that have nothing to do with the original infected device.

How a Stealer Log Like This Gets Made

Stealer malware infects a victim's device, often through pirated software or a malicious download, and quietly scrapes every saved password, autofill entry, and active session from the browser. The stolen data is compiled into a log file and, in this case, released publicly on Telegram as CuckooLogsPublic-20250923, likely to promote the group or tool behind the malware.

Check If You Are Affected

HEROIC's free breach scanner checks your email against more than 400 billion exposed records, including public stealer logs like this one. Search your email now to find out if your credentials appear in CuckooLogsPublic-20250923 and get clear next steps to secure your accounts.