doc_2022-06-26_23-50-24.EDU 2.7K Leak: Your Password Could Be Inside

Inside the "doc_2022-06-26_23-50-24.EDU 2.7K" Stealer Log

In May 2023, HEROIC analysts identified a stealer log file named "doc_2022-06-26_23-50-24.EDU 2.7K" circulating on a Telegram channel. The file contained 2,584 records taken from infected devices, pairing email addresses with plaintext passwords and the exact login URLs those credentials belong to.

Why This Is Dangerous

The ".EDU" tag on this log suggests many of the harvested credentials are tied to academic email accounts, often used to log into student portals, cloud storage, and other campus systems. Because the passwords are stored in plain text and matched to specific URLs, an attacker can log in directly without guessing which service each password unlocks.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs identifying the exact site each credential logs into

Why This Matters

Even a small log like this one carries real risk for the 2,584 people in it. Reused passwords open the door to credential stuffing on email, banking, and social media accounts. Because student accounts often link to personal email and financial aid systems, a compromised .edu login can be a stepping stone to broader identity theft.

How Stealer Logs Work

Stealer malware infects a device, often through a cracked application or malicious download, then quietly copies every password and autofill entry saved in the browser. That data is sent back to the attacker and repackaged into a log file like this one, which is then shared or sold in Telegram groups and dark web marketplaces.

Check If You Are Affected

HEROIC's free breach scanner checks your email against more than 400 billion breached records, including stealer logs like this one. Run a free scan to see if your credentials are part of this leak or any other exposure on record.