How Malware Captured 6,180 Logins in the Zelenkalink 151 Leak

A batch of infostealer malware infections on May 26, 2026 ended with 6,180 logins packaged into a file called "zelenkalink 151- ScroogeUrl" and uploaded straight to Telegram. Here's roughly how it happened, step by step.

Why This Is Dangerous

Understanding the mechanics matters because it shows how little effort is actually required. There's no genius hacker cracking encryption in this story, just malware doing exactly what it was built to do, quietly and efficiently.

What Was Exposed

• 6,180 email addresses collected from infected browsers
• Plaintext passwords with zero encryption applied
• URLs showing precisely which service each login belongs to

Why This Matters

Once you understand how automatic the process is, the 6,180 number stops feeling like a headline and starts feeling like a warning. If your device was ever infected, even briefly, your saved logins could already be sitting in a file just like this one.

How It Happened, Step by Step

First, a victim downloads something infected, often disguised as a game cheat, cracked software, or fake browser update. Second, the malware runs quietly in the background and scans the browser for saved passwords, autofill data, and active sessions. Third, everything it finds gets bundled into a file and sent back to the attacker's server. Finally, that data, in this case 6,180 records worth, gets uploaded to a Telegram channel wich hundreds or thousands of people can access within minutes.

Check If You Are Affected

Now that you know how it happens, checking whether it happened to you should be the next step. HEROIC's free scanner searches more than 400 billion leaked records, and it will definately show you if your email is part of this particular 6,180 record leak.