DeNumCheckedWhatsappReg Leak Targets US WhatsApp Users: 5,085 Exposed

In February 2026, a Telegram user uploaded a stealer log dataset labeled "DeNumCheckedWhatsappReg," exposing 5,085 records tied to United States accounts. The file contains email addresses, plaintext passwords, and URLs pulled from malware-infected devices. The name of the file suggests it was compiled by checking phone numbers against WhatsApp's registration system, but this is not a breach of WhatsApp's own servers. It is a stealer log built from individually infected devices and later organized around WhatsApp-linked accounts.

Who This WhatsApp-Linked Leak Targets

This dataset appears to focus specifically on US-based accounts connected to WhatsApp, one of the most widely used messaging apps in the world. Because so many people link a single email address to their WhatsApp account, a banking app, and a shopping account, anyone whose information appears in a dataset like this is at elevated risk, not just for their WhatsApp login but for every other account tied to that same email and password.

What Was Exposed in the DeNumCheckedWhatsappReg Leak

• Email addresses
• Plaintext passwords
• URLs tied to the accounts checked

Why This Matters If You Use WhatsApp

Plaintext passwords are ready to use the moment they are stolen, with no cracking required. Attackers commonly take email and password combinations like these and run them against other popular services in a technique called credential stuffing, hoping the same password was reused. If it was, a single leaked login can lead to account takeover, identity theft, or unauthorized access to messages, contacts, and any payment information linked to that account.

How This Stealer Log Was Likely Built

Stealer malware infects a device, often through a fake app, cracked software, or malicious link, and silently copies saved passwords and browsing data straight from the browser. Once collected, criminals often cross-check the stolen email and password pairs against services like WhatsApp to confirm which ones are still active, then package the working results into a targeted list like this one before sharing it on Telegram.

Check If Your Account Was Exposed

If you use WhatsApp or any linked email account, it is worth finding out whether your information appears in this leak or in any other breach. HEROIC's free breach scanner checks your email against more than 400 billion leaked records and tells you instantly if you have been exposed. Run a free scan now to see where you stand.