1,946 Plaintext Passwords in the Dead Souls Private Stealer Log

In November 2022, HEROIC identified 1,946 records from a stealer log file uploaded to Telegram by an anonymous user under the name Dead Souls Private. The data was shared publicly on Telegram and contained email addresses, plaintext passwords, and URLs associated with compromised endpoints.

Why the Dead Souls Private Stealer Log Is Dangerous

The 1,946 credentials in this log were each captured live at the exact moment of login -- email address, password, and the URL of the site being accessed, all recorded in plaintext by infostealer malware. No cracking is required. Attackers receive working credentials directly.

What Was Exposed in the Dead Souls Private Leak

• Email addresses
• Plaintext passwords
• URLs of compromised endpoints

Why This Dead Souls Private Data Puts You at Risk

The URLs in stealer logs map attackers directly to specific accounts on specific platforms -- there is no guesswork. Credentials stolen in November 2022 remain active on any account where the password has not been changed since the compromise. Telegram distribution means thousands of threat actors have had access to this data for years.

How Stealer Log Breaches Work

Infostealers spread through phishing emails and trojanized software downloads. Once installed, the malware hooks into the browser's credential store and intercepts logins as they happen, capturing the email address, password, and the URL of the site being accessed. These records are packaged into log files and uploaded to command-and-control servers, then redistributed through Telegram channels where they are sold or shared freely.

Check If Your Data Was Exposed

HEROIC operates one of the world's largest breach databases, covering more than 400 billion leaked records. Use HEROIC's free breach scanner to check if your email address or credentials appeared in this stealer log or thousands of other breaches in our database.