ErernityRevil 1 Telegram Leak: One Password Opens Bank, Email, and More

EternityRevil Stealer Log Uploaded to Telegram Exposed 15,965 Records

HEROIC analysts identified the ErernityRevil 1 stealer log dataset uploaded by a Telegram user in July 2023 that exposed 15,965 records. The dataset included email addresses, plaintext passwords, and URLs harvested by the EternityRevil infostealer malware family. EternityRevil is a well-documented malware-as-a-service tool sold on dark web forums, making this leak particularly dangerous given the organized criminal infrastructure behind it.

Why This Is Dangerous

The EternityRevil malware family is sold as a subscription service on dark web forums, meaning multiple threat actors have access to the same tools and distribution channels. Credentials stolen via EternityRevil are frequently shared across Telegram channels and criminal marketplaces, broadening the potential for misuse. An attacker with this data can chain access across email, banking, and social media platforms using the same stolen credentials.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs (target site context for each stolen credential)

Why This Matters

When plaintext passwords and email addresses are combined with specific target URLs, attackers have everything needed to execute immediate account takeovers. This data enables credential stuffing against hundreds of platforms, identity theft through compromised email access, financial fraud via banking and payment portal logins, and further lateral movement into corporate networks if work credentials were among those stolen.

How EternityRevil Stealer Logs Work

EternityRevil is a malware-as-a-service infostealer that cybercriminals purchase via Telegram subscription. Once deployed on a victim's machine, it silently harvests saved browser passwords, autofill data, cookies, and session tokens. The stolen data is compiled into log files and uploaded to Telegram channels where buyers -- and anyone they share with -- can access thousands of working credential pairs. The victim rarely knows their data has been stolen.

Check If You Are Affected

Your credentials may be in this leak or in any of the 400 billion+ records indexed in HEROIC's breach database. Use HEROIC's free breach scanner to check your exposure instantly -- no account required.