How Malware Led to 452 Stolen Logins in the 460 X USA Dump

HEROIC analysts traced a stealer log titled "460 X USA" that was shared on a Telegram channel on June 30, 2026. The dump contains 452 records of US-based credentials stolen by infostealer malware. Each entry includes the victim's email address, their plaintext password, and the URLs they were browsing at the time their data was captured. The file represents yet another batch of American credentials being freely distributed to anyone monitoring these channels.

The naming convention "460 X USA" suggests the uploader initially cataloged approximately 460 US-focused credential sets, with 452 valid records making it into the final file. This type of regional targeting is common among stealer log distributors who package data by country for buyers with specific geographic interests.

Why Plaintext Passwords Give Attackers a Head Start

The passwords in this dump are stored in plaintext, fully readable without any decryption. When a stealer log contains plaintext credentials, the time between downloading the file and attempting unauthorized logins is effectively zero. Attackers can copy an email-password pair and paste it directly into a login form, or feed the entire file into automated tools that test combinations at scale.

This immediacy is what makes stealer log credentials more dangerous than passwords exposed in traditional data breaches, where passwords are often hashed and require significant computing power to crack. With plaintext exposure, every second counts for victims who have not yet changed their passwords.

What Was Exposed in the 460 X USA Dump

• Email Addresses — US-based accounts from various email providers, giving attackers entry points to services ranging from online banking to healthcare portals.
• Plaintext Passwords — Unencrypted, ready-to-use passwords harvested directly from victims' web browsers by infostealer malware.
• URLs — The specific websites and services that victims were logged into during the infection, mapping out which accounts are immediately vulnerable.

Why 452 Stolen US Credentials Ripple Across the Web

Each stolen credential in this dump is a thread that connects to a wider web of accounts. Most people use the same password for their email, social media, streaming services, and even financial accounts. When attackers obtain 452 email-password pairs, they test each combination against popular services like Amazon, Netflix, PayPal, and major banking platforms.

US-based credentials are particularly valuable because American consumers typically have more online accounts per person than users in most other countries. A single US credential set may unlock access to retail accounts with saved payment methods, investment platforms, tax filing services, and employer-provided tools. The potential financial damage from just one successful takeover can be substantial.

How Stealer Logs Follow the Path from Infection to Telegram

The journey begins when a user unknowingly installs infostealer malware, often disguised as a legitimate software download, a game cheat, or a cracked application. The malware immediately begins extracting credentials stored in web browsers, including usernames, passwords, and session cookies for every site the victim has logged into.

Once the data is collected, it is packaged into a structured log file and uploaded to the attacker's server. From there, the logs enter a distribution pipeline that often ends on Telegram, where they are shared freely or sold at low prices. The "460 X USA" dump is one of countless files circulating through these channels daily, each containing a fresh batch of stolen credentials ready for exploitation.

Check If Your Credentials Appear in This Leak

If you are located in the United States and regularly save passwords in your web browser, your credentials may have been swept up in this or a similar stealer log. HEROIC offers a free breach scanner that checks your email against over 400 billion compromised records from stealer logs, data breaches, and dark web sources.

Search your email address now to determine if your login information was exposed in the 460 X USA dump or any other known breach. If you discover a match, change your password on the affected service and everywhere else you have used that same password. Activating two-factor authentication will provide an additional safeguard against unauthorized access.