How Malware Led to 10,708 Stolen Logins in the Corps Base Dump

HEROIC's threat intelligence systems flagged a stealer log collection known as 10k Corps Base circulating on Telegram. Dated February 2023, this corporate-focused dataset contains 10,708 records stolen by infostealer malware, including email addresses, plaintext passwords, and the URLs of services and portals where employees entered their credentials.

Plaintext Corporate Passwords Are a Direct Entry Point

The credentials in this dump are not hashed or encrypted—they are stored in plaintext, identical to what users typed at their keyboards. For corporate accounts, this is especially dangerous. A single plaintext password can provide direct access to internal systems, VPNs, cloud platforms, and sensitive business data. With 10,708 corporate credentials exposed, the potential for enterprise-level breaches is significant.

What Was Exposed

• Email Addresses — corporate and personal email accounts used as login identifiers
• Plaintext Passwords — unencrypted credentials ready for immediate use by attackers
• URLs — enterprise portals, SaaS platforms, and web applications where credentials were captured

From One Password to Full Corporate Access

Credential stuffing poses a particularly severe threat to corporate environments. Employees who reuse their work passwords on personal accounts—or vice versa—create a bridge between public breaches and internal systems. Attackers use automated tools to test the 10,708 stolen pairs against corporate email, Microsoft 365, Slack, AWS consoles, and other business platforms. A single match can lead to lateral movement within a network, data exfiltration, or ransomware deployment.

The Infostealer Attack Chain Explained

The 10k Corps Base data was harvested through infostealer malware infections. These attacks typically begin when an employee clicks a phishing link, downloads a compromised file, or installs cracked software. The malware—variants like RedLine, Lumma, or Raccoon—then silently extracts every saved password from the victim's browsers, along with cookies and autofill data. The stolen credentials are organized by domain into log files and distributed through dark web markets and Telegram channels to buyers looking for corporate access.

Check If Your Credentials Were Exposed

HEROIC maintains a breach intelligence database of over 400 billion records sourced from data breaches, stealer logs, and dark web monitoring operations. Use HEROIC's free breach scanner to check whether your corporate or personal email appears in the 10k Corps Base leak or any other known compromise. If your credentials are found, reset your password immediately, audit all accounts using the same credentials, and enable multi-factor authentication across your organization.