How Malware Led to 128 Stolen Logins in the ABV.BG Dump

HEROIC's DarkHive threat intelligence platform traced a stealer log file titled "ABV.BG Valid Access" that appeared on Telegram in November 2024. The dataset targets users of ABV.BG, one of Bulgaria's most widely used email providers, and contains 128 records. Each record was captured by infostealer malware installed on victims' devices, harvesting email addresses, plaintext passwords, and the URLs of services where those credentials were entered.

Plaintext Passwords Eliminate All Protection

Every password in this dump appears in its original, unencrypted form. For the 128 affected ABV.BG users, this means their account passwords are fully visible to anyone who downloads the file. There is no hashing to reverse and no encryption to break — each credential is directly exploitable for logging into the associated accounts without any additional effort.

What Was Exposed

• Email Addresses — ABV.BG accounts used as primary email across Bulgarian and international platforms
• Plaintext Passwords — validated as working credentials at the time of capture
• URLs — showing which websites and portals each credential was used on

Small Dumps, Outsized Risk Through Credential Reuse

While 128 records may seem small, each one represents a real person whose credentials are now available to criminals. Because many users rely on the same password for their email, social media, and financial accounts, even a single compromised ABV.BG login can become a launching point for attacks across multiple services. Credential stuffing bots can test these 128 pairs against thousands of websites in minutes.

The Journey From Infected Device to Telegram Channel

The path of these stolen credentials follows a well-established pattern. A victim unknowingly installs infostealer malware — perhaps through a phishing email or a compromised download. The malware immediately begins extracting saved passwords from web browsers, capturing login keystrokes, and copying session cookies. This data is packaged into a structured log file and sent to the attacker, who curates and labels it (in this case, filtering for ABV.BG hits) before uploading it to Telegram for distribution.

Check If Your Credentials Were Exposed

With over 400 billion compromised records in its database, HEROIC provides one of the most thorough breach detection services available. Search your ABV.BG email address or any other email using HEROIC's free breach scanner to find out if your credentials were included in this dump. If you discover a match, change your password immediately and review all accounts that share the same login credentials.