Found on Telegram: EXPERTLOGS Bases6 and Its 72,496 Records

Not long after Bases5 turned up, its sibling file surfaced too. EXPERTLOGS Bases6, dated February 13, 2023, was found making the rounds on the same Telegram network, carrying 72,496 records of stolen login data in the exact same URL, email, password format.

Why This Is Dangerous

Finding a sequel to an earlier leak is a signal in itself, it tells researchers this isn't a one-off event but part of a repeated operation. Each new batch means fresh victims and fresh opportunities for whoever is running the credential harvesting behind the scenes.

What Was Exposed

• 72,496 email addresses collected from infected users
• Plaintext passwords tied directly to each address
• URLs mapping every login to the site it opens

Why This Matters

Its neccessary to think about numbered leaks differently than isolated ones. If Bases5 and Bases6 both exist, the group behind them has an active pipeline of infections feeding new logs on an ongoing basis, wich means checking once isn't really enough, you may need to check again down the road.

Why These Logs Keep Appearing

Series like this one usually come from a stealer-as-a-service setup, where the malware is rented out to other criminals who spread it through phishing campaigns, fake downloads, or malicious ads, then hand collected credentials back to whoever packages and numbers the resulting logs.

Check If You Are Affected

Given that this appears to be part of an ongoing series, its worth checking regularly, not just once. HEROIC's free scanner covers more than 400 billion leaked records, including both Bases5 and Bases6, so you can stay ahead of whatever comes next.