Researchers Flag facebook.com Stealer Log Leaking 23,983 Credentials

HEROIC analysts confirmed a stealer log file containing 23,983 records linked to facebook.com credentials was uploaded to a public Telegram channel on October 30, 2023. The log was assembled by infostealer malware running on infected user devices, capturing email addresses, plaintext passwords, and the associated URLs at the moment of exfiltration. With nearly 24,000 records and Facebook credentials specifically in the mix, this dataset gives attackers a direct path into some of the most widely used personal and business accounts on the internet.

Why facebook.com Credentials in This Log Are Especially Dangerous

Facebook accounts are not just social profiles. For millions of people they are the single sign-on key to dozens of other services, business ad accounts, marketplace transactions, and Messenger communications. A stolen Facebook password in plaintext, paired with the user's email address, gives an attacker everything needed to log in immediately, without cracking or guessing. From there, they can lock the original owner out by changing the password and recovery email, take over connected apps, access Facebook Pay, or use the account to run scam ads at the victim's expense. Because the URLs in this log confirm which records are tied to facebook.com specifically, attackers can sort and prioritize those entries instantly.

What Was Exposed in the facebook.com Stealer Log

• Email addresses used to log into Facebook accounts
• Plaintext passwords captured directly from infected devices
• Facebook.com URLs confirming which records belong to this platform
• Endpoint identifiers linking records to specific compromised machines

Why This Matters: Account Takeover, Identity Theft, and Financial Fraud

The risks from a Facebook credential leak extend well beyond losing access to a social media feed. Attackers who gain entry to a Facebook account can harvest personal information for identity theft, contact the victim's friends with scam messages, access linked payment methods, and exploit any business pages or ad accounts attached to the profile. If the same email and password combination is reused on other platforms, the damage multiplies. Email accounts breached with the same credentials can be used to reset passwords on banking, shopping, and workplace services. A single record in this log has the potential to trigger a chain of compromises that reaches far beyond Facebook itself. The fact that this data was shared freely on Telegram means the number of people who could have downloaded and acted on it is esentially unlimited.

How This facebook.com Stealer Log Was Created

Infostealer malware infects a device and immediately begins searching for anything valuable. It extracts saved passwords from web browsers, records credentials as they are typed into login forms, and collects session cookies that can allow attackers to impersonate a logged-in user without even needing the password. For Facebook specifically, infostealers can capture both the login credentials and active session tokens, which bypass two-factor authentication by mimicking an already authenticated session. Once collected, all of this data is packaged into a structured log file and transmitted to the attacker. The file is then either sold or, as happened here, distributed freely on public Telegram channels to maximize its reach and use.

Check If Your facebook.com Credentials Were Exposed

HEROIC's free breach scanner searches more than 400 billion compromised records, including this facebook.com stealer log from October 2023. Enter your email address to find out if your credentials apeared in this dataset or any other known breach. If your account shows up, change your Facebook password immediately, revoke access to any third-party apps connected to your account, and turn on two-factor authentication. Do not wait, because attackers who downloaded this log have had months to act on what was in it.