How Malware Led to 268,851 Stolen Logins in the Gmail Part2 Dump

HEROIC analysts discovered a stealer log collection labeled "Gmail Part2 6," uploaded to a Telegram channel in May 2023. This dataset contains 268,851 records extracted from malware-infected devices, revealing email addresses, plaintext passwords, and the URLs associated with each compromised login.

The naming convention suggests this dump is part of a larger series of Gmail-focused credential collections, indicating a sustained campaign of harvesting login data from users of Google's email platform. The data was shared publicly on Telegram, putting hundreds of thousands of accounts at immediate risk.

Why Plaintext Passwords Are an Immediate Threat

Every password in the Gmail Part2 dump is stored as readable, unencrypted text. There is no hashing algorithm to slow down attackers, no salting to complicate brute-force efforts. Each credential can be copied and pasted directly into a login form, granting instant access to the associated account.

For Gmail accounts specifically, the consequences are severe. A compromised Gmail password can provide access to the entire Google ecosystem, including Drive, Photos, Calendar, and any third-party service that uses Google as a sign-in provider. Attackers who gain entry to a Gmail account can also intercept password reset emails for other platforms, enabling a rapid cascade of account takeovers.

What Was Exposed in the Gmail Part2 Dump

• Email Addresses — Gmail and other email addresses used as login identifiers across various online services. These addresses are prime targets for phishing and social engineering attacks.
• Plaintext Passwords — Unencrypted passwords stolen directly from browser password stores and autofill databases by infostealer malware, ready for immediate exploitation.
• URLs — The exact login pages and web services where stolen credentials were entered, providing attackers with a direct map to each victim's active accounts.

Why 268,851 Compromised Accounts Create a Ripple Effect

Studies show that the average person reuses the same password across five or more accounts. With 268,851 credential pairs in this collection, the true number of vulnerable accounts could exceed one million. Each stolen login is a key that may unlock not just one door, but many.

Credential stuffing attacks exploit this reality at industrial scale. Automated bots take the email and password combinations from dumps like Gmail Part2 and systematically test them against banking portals, e-commerce sites, corporate VPNs, and social media platforms. The success rate for credential stuffing typically ranges from 0.1% to 2%, which in a dataset of this size translates to hundreds or thousands of additional compromised accounts.

The financial impact compounds quickly. Attackers who breach an email account can authorize fraudulent transactions, access stored payment methods, and manipulate account recovery options to lock legitimate users out permanently.

How Stealer Logs Harvest Gmail Credentials

The credentials in this dump were not obtained through a breach of Google's servers. Instead, infostealer malware running on individual users' devices silently captured login data as it was typed or retrieved from browser storage. Common infostealers like RedLine, Raccoon, and Vidar target saved passwords in Chrome, Firefox, and Edge, exfiltrating them along with cookies and session tokens.

Victims typically contract infostealer malware through deceptive means: a cracked software download, a phishing email with a malicious attachment, or a compromised advertisement that redirects to an exploit kit. The malware runs briefly, harvests everything of value, and transmits the data before many antivirus solutions can detect it.

Once collected, these stolen credentials are organized into structured log files and distributed through Telegram channels and dark web forums. The Gmail Part2 dump represents just one segment of what is likely a much larger collection, with the data freely available to anyone who knows where to look.

Check If Your Credentials Appear in This Leak

Gmail users who have ever saved their password in a browser or downloaded software from unofficial sources should treat this leak as a serious warning. Even if your device appeared to function normally, infostealer malware may have already extracted and transmitted your credentials.

Use HEROIC's free breach scanner, which indexes over 400 billion compromised records, to determine whether your email address and password appear in the Gmail Part2 dump or any other known breach. If your credentials are found, change your Google password immediately, revoke active sessions in your Google account security settings, and enable two-factor authentication if you have not already done so.