The CuckooLogsPublic Stealer Log Contains Exactly 4,476 Password Pairs

HEROIC analysts found a stealer log titled "CuckooLogsPublic-20250603" uploaded to a public Telegram channel on June 3, 2025. The file contains exactly 4,476 records, each pairing an email address with a plaintext password and the URL of the login page it belongs to, pulled directly from infected devices.

Why This Is Dangerous

Because the passwords in this log were never encrypted, anyone who downloads the file can read every credential immediately, no cracking required. Paired with the matching email address and URL, an attacker has everything needed to log straight into an account without any additional effort or technical skill.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the associated login pages

Why This Matters

Even a precise, modest count like 4,476 records is enough to cause real damage, since people so often reuse the same password across multiple sites. Attackers run exposed email and password pairs like these through credential stuffing tools against banking, email, and shopping accounts. A single match can lead to account takeover, identity theft, and financial fraud for the person affected.

How This Stealer Log Was Created

Stealer malware infects a device through a malicious download or link, then quietly scans the browser for saved logins and autofill data. It captures each username and password together with the web address it belongs to, bundles everything into a single log file, and sends it back to the attacker, who then shares or sells it, as happened here on a public Telegram channel.

Check If You Are Affected

If your credentials might be among the 4,476 records in this log, it is worth checking now. HEROIC's free breach scanner checks your email against more than 400 billion leaked records, including stealer logs like this one, so you can secure your accounts before someone else does.