Inside the Ethome.net.tw Leak: How Malware Stole 15,571

Inside the ethome.net.tw leak: how malware stole 15,571 passwords after a Telegram user uploaded the stealer log file on 10-Jun-2026. HEROIC analysts reviewed the dataset and confirmed it contains email addresses, plaintext passwords, and the URLs those credentials were used on.

Why This Is Dangerous

This dataset shows exactly how stealer malware operates: it does not break into a company's servers, it sits quietly on individual devices and records whatever passwords the user types or has saved in their browser. Because each password in this file is paired with the exact URL it was used on, an attacker can go straight to that login page and attempt access with no extra digging required.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated login URLs

Why This Matters

Plaintext passwords can be used the instant someone opens the file, with no cracking or decoding step involved. If any of these 15,571 people reused their password on another account, attackers can attempt credential stuffing against email, banking, or shopping logins. That kind of access frequently leads to account takeover, identity theft, or direct financial fraud.

How Stealer Log Leaks Work

Stealer log malware usually spreads through cracked software, fake downloads, or malicious email attachments. Once it infects a device, it silently extracts saved browser passwords and autofill data, then sends the stolen information back to the attacker running the malware. That data is bundled into a log file and shared or sold on Telegram channels and dark web forums, often within days of infection, which is why the credentials tend to still be valid when discovered.

Check If You Are Affected

If you have ever used a login connected to ethome.net.tw, or you tend to reuse passwords across accounts, it is worth checking your exposure today. HEROIC's free breach scanner searches more than 400 billion leaked records, including stealer log data like this one, to tell you whether your email has surfaced. Run a free scan and update any reused passwords immediately if you find a match.