The Good_Ads Leak Put 1,724 Stolen Email and Password Pairs Online

HEROIC analysts found a stealer log called "Good_Ads" uploaded to a Telegram channel on December 23, 2023. The file exposed 1,724 records tied to U.S. users, including email addresses, plaintext passwords, and the API host URLs those credentials belong to.

Why This Leak Is Dangerous

Every password in this file was stored in plaintext, so no cracking or decoding stands between an attacker and the account it unlocks. Each password is also matched to the specific URL it was used on, giving anyone who finds the file a direct route to log in.

What Was Exposed in the Good_Ads Leak

• Email addresses
• Plaintext passwords
• API host URLs tied to each login

Why This Matters

A file of 1,724 working email and password pairs is exactly the kind of data attackers use for credential stuffing, testing the same login across other websites in hopes of a match. Anyone in this leak who reused a password elsewhere faces a real risk of account takeover, and the identity theft or fraud that can follow.

How This Stealer Log Was Created

Stealer logs like "Good_Ads" come from malware that infects a device and quietly copies saved passwords, browser autofill data, and login sessions. The stolen data is packaged into a log file and shared or sold on Telegram, exactly how HEROIC found this one on December 23, 2023.

Check If Your Email Was Exposed

If you want to know whether your credentials appear in the Good_Ads log or any other leaked stealer log, HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records. Run a scan now to see if your information has surfaced.