Forza Traffic Stealer Log Leaked 62,460 Plaintext Passwords

On August 22nd, 2025, a Telegram user uploaded a stealer log labeled "Forza TrafficArhontCloud." HEROIC analysts confirmed the file contained 62,460 records pairing email addresses with plaintext passwords and the URLs each login was captured from, credentials taken directly from devices infected with information-stealing malware.

Why This Is Dangerous

Every one of the 62,460 passwords in this file is stored in plain, readable text and matched to the exact site it unlocks. No cracking or decryption is required, so an attacker can begin testing logins the moment they obtain the file.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs (the login pages or API hosts tied to each credential)

Why This Matters

A file of this size gives credential stuffing operations a large pool of working logins to run against banking, email, and shopping accounts. Because password reuse is common, a single leaked credential can lead to account takeover, identity theft, or financial fraud on accounts that were never directly targeted.

How Stealer Log Breaches Work

Infostealer malware infects a device, often through a malicious download or cracked software, and silently copies every password, cookie, and autofill entry saved in the browser. Once enough infections accumulate, the stolen data is compiled into a log like this Forza Traffic file and distributed through Telegram channels and dark web forums.

Check If You Are Affected

This Forza Traffic stealer log is now included in the more than 400 billion breached records HEROIC tracks. Run a free scan with your email address to find out if your credentials were exposed in this leak.