HEROIC Analysts Found the abv.bg Dump Circulating on Telegram

HEROIC analysts found a stealer log file shared on Telegram in December 2022 exposing 701 records linked to abv.bg, one of Bulgaria's most widely used webmail services. The dataset contains email addresses, plaintext passwords, and associated URLs captured from infected devices. The targeted nature of this dataset, focusing on a specific regional mail provider, suggests the malware operator had particular interest in Bulgarian email account holders.

Why Regional Email Credentials Are Especially Valuable to Attackers

Email accounts are the master keys to most digital lives. With access to an abv.bg email account, an attacker can trigger password resets on any linked service, read private messages, and impersonate the victim in communications. Targeting a specific regional provider like abv.bg allows threat actors to build focused credential lists that are highly likely to contain active accounts, making them more valuable for account takeover operations.

What the abv.bg Leak Exposed

• Email Addresses
• Plaintext Passwords
• URLs (abv.bg and associated login pages)

How Compromised Email Accounts Enable Identity Theft and Account Takeover

An attacker who gains access to a victim's email account holds the key to their entire online presence. Most account recovery processes rely on email verification, meaning a hijacked inbox can be used to reset passwords on banking, shopping, and social media accounts. Victims of email account takeover often discover the breach only after facing financial loss or identity theft.

How Stealer Log Breaches Work

Stealer logs are built by malware installed on a victim's device that captures login credentials in real time. As the victim logs into their email or other accounts, the malware records the username, password, and URL and packages the data for exfiltration. These logs are then shared through Telegram channels and criminal forums. HEROIC analysts monitor these distribution channels to identify and catalog newly surfaced breach data.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches more than 400 billion exposed records and covers datasets like this abv.bg stealer log. If your email address appears in this or any other known breach, you will receive an immediate result so you can act to protect your accounts.