Our Analysts Found the FortunaFree Stealer Dump Circulating on Telegram in 2023

HEROIC analysts found the FortunaFree stealer log circulating on Telegram in August 2023. The file contained 5,931 records collected from compromised devices and included email addresses, plaintext passwords, and the URLs of the accounts from which those credentials were stolen. The name FortunaFree suggests the log was distributed freely by its uploader, meaning anyone monitoring the channel where it appeared could download the full dataset without payment or vetting.

Why Freely Distributed Stealer Logs Are Especially Concerning

When a threat actor charges for credential data, access is at least somewhat limited to those willing to pay. Free logs carry no such barrier. The FortunaFree file was available to every member of the channel where it appeared, which on active Telegram stealer communities can number in the thousands. Each download represents another potential attacker who now has valid email and password combinations ready to test. With plaintext passwords included, there is no technical skill required to use this data against real accounts.

What Was Exposed in This Leak

• Email Addresses
• Plaintext Passwords
• URLs (the exact sites where stolen credentials were used)

Why This Matters for Credential Stuffing and Account Fraud

Stealer log data with URL pairings is the most immediately actionable form of stolen credentials. Attackers do not need to guess which services a victim uses or run wide-net stuffing campaigns. The FortunaFree file tells them directly. This makes account takeover faster and more targeted. Financial accounts, email inboxes, and business tools tied to any of the URLs in this log are all at risk. Unauthorized access often goes undetected until visible damage occurs, such as locked accounts, unauthorized purchases, or data being weaponized for further phishing.

How Stealer Logs End Up on Telegram for Free

Infostealer operators typically distribute malware, collect logs from infected machines, and then monetize the data by selling or sharing it. Free distribution often serves as advertising: a way to build reputation in underground communities, attract buyers for larger datasets, or recruit collaborators. The FortunaFree release fits this pattern. An operator running a stealer campaign uploads a sample or a full file labeled as free to generate attention and downloads. The data itself comes from real users whose devices were infected through phishing, malicious downloads, or compromised software. Each of the 5,931 records in this file represents a real person whose online accounts were silently harvested.

Check If You Appear in the FortunaFree Log

HEROIC analysts track free log releases from Telegram and dark web channels as part of a breach database covering more than 400 billion exposed records. If your email address was in the FortunaFree file, HEROIC's free breach scanner will show it. Enter your email at the HEROIC breach search tool to find out which data leaks have exposed your credentials and which accounts may be at risk.