Dark Web Alert: Brazilian ‘User_Pass’ Dump Leaks 371,041 Logins

HEROIC's dark web monitoring identified a stealer log dump labeled "380K Br Brazilian User_Pass" circulating on Telegram in April 2023. The file contains 371,041 records tied to Brazilian accounts, pulled from malware-infected devices rather than any single company's servers. Like most stealer logs, it pairs stolen emails and passwords with the exact site URL they unlock, making it a ready-to-use toolkit rather than a random data dump.

Dark Web Intelligence: What Was Found

Threat actors on Telegram routinely trade files like "380K Br Brazilian User_Pass" in private channels, often bundling them by country or language to make them easier to sell to buyers targeting a specific region. The "Br" and "Brazilian" tags on this file signal it was marketed specifically toward criminals looking for Brazilian accounts, and the 371,041 records inside were stored and shared in plaintext, meaning no cracking is required before they can be used.

What Was Exposed in This Dump

• Email addresses
• Plaintext passwords
• URLs (the sites each login pairs with)

Why Dark Web Monitoring Catches Files Like This

Stealer logs like this one rarely make headlines the way a major corporate breach does, but they move through dark web channels constantly and often go unnoticed by the people affected. Because the credentials here are already paired with working site URLs, they're primed for credential stuffing, account takeover, identity theft, and financial fraud the moment a buyer decides to use them, which is exactly why continuous monitoring matters more than a one-time check.

How This Kind of Dark Web Listing Gets Created

Infostealer malware infects a device through a cracked download, fake update, or malicious attachment, then quietly harvests saved passwords and browser data before sending it back to the attacker. Files like "380K Br Brazilian User_Pass" are the packaged result, uploaded and traded on Telegram where dark web intelligence teams like HEROIC's track them down and add the exposed records to searchable breach databases.

Check If You Are Affected

Dark web listings like this one surface constantly, and most people never find out their credentials were included. HEROIC's free breach scanner checks your email against more than 400 billion leaked records pulled from breaches and dark web monitoring, so you can find out in seconds if you were exposed and act before your reused passwords are used against you.