Dark Web Intel: TXTLOGS 2 Leak Exposes 2.7 Million Login Records

Dark web intel gathered by HEROIC's research team flagged a massive stealer log called "NEW TXTLOGS 2," uploaded to Telegram on 13-Mar-2025. The file contains 2,718,720 records, making it one of the larger stealer dumps HEROIC has tracked recently moving through underground channels.

Why This Is Dangerous

Files of this size don't stay in one place for long. Once something like this circulates on the dark web, it gets copied across multiple seperate forums and Telegram channels within days, each repost reaching a new group of criminals who didn't have access to it before. The bigger the file, the faster and further it tends to spread.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs tied to each account
• 2,718,720 total records exposed

Why This Matters

A leak this size gives attackers enormous scale to work with, running automated tools that test millions of email and password combinations against banks, retailers, and email providers all at once. If your credentials occured to be part of this file, you likely won't recieve any direct notice, since there's no single company responsible for reporting it.

How Stealer Logs Work

A file this large usually isn't the output of one infection, it's a compiled collection of many smaller stealer logs merged together into a single dump. Malware on individual infected devices each contribute their own harvested passwords and browser data, and someone eventually stitches all those results into one giant text file like this one.

Check If You Are Affected

With millions of records now circulating, checking your exposure is worth the two minutes it takes. HEROIC's free breach scanner searches more than 400 billion compromised records, including this TXTLOGS 2 dump, so you know exactly where you stand.