“Fresh” KURZL0GS_UP Batch Leaks 23,472 Plaintext Passwords

"22K-PCS FRESH Part 6": Inside the KURZL0GS_UP Stealer Log

The label on this file tells its own story: "22K-PCS FRESH Part 6" marks it as the sixth batch in a series, marketed as fresh to attract buyers looking for recently collected credentials. HEROIC analysts identified this KURZL0GS_UP stealer log uploaded to a Telegram channel on 24 July 2026, containing 23,472 records pulled directly from infected devices. Each record pairs an email address and plaintext password with the URL of the account it unlocks.

Why This Stealer Log Is Dangerous

Being labeled "fresh" matters here: it signals the credentials were collected recently, meaning they're more likely to still be active than data sitting unused for years. Because KURZL0GS_UP pairs each password with the exact site it opens, an attacker doesn't need to guess anything. With 23,472 records to work through, that's a substantial number of ready-made login attempts requiring no cracking at all.

What Was Exposed

• Email addresses tied to individual accounts
• Plaintext passwords for those accounts
• URLs identifying exactly which sites the credentials belong to

Why This Matters

Account takeover is the most direct risk, since attackers already have everything needed to log in without cracking or guessing. Credential stuffing extends that risk further: because many people reuse the same password across different accounts, a login found in KURZL0GS_UP could unlock a victim's email, banking, or shopping account on a completely different site than the one it was originally taken from.

How Stealer Logs Work

Stealer logs come from malware that quietly infects a device, often disguised as pirated software or a fake download, and then harvests saved browser passwords along with the exact sites they belong to. Criminals often split large hauls into numbered parts, like this "Part 6," and label them fresh to keep buyers coming back for each new batch as it's uploaded, in this case to a Telegram channel.

Check If You Are Affected

If you want to know whether your information turned up in this KURZL0GS_UP batch or any other leak, HEROIC's free breach scanner checks your email address against a database of more than 400 billion leaked records. Run a free scan today to find out and see which passwords you should change.