How Malware Led to 14,528 Stolen Logins in the HQ EU Dump

In September 2024, a Telegram user known as professor66699 shared a stealer log collection titled "HQ EU Combo" that HEROIC flagged during routine dark web monitoring. This dump contains 14,528 compromised records focused on European users, with plaintext passwords that trace back to infostealer malware infections on individual devices.

Unencrypted Passwords Put Victims at Immediate Risk

Every credential in the HQ EU Combo dump is stored in plaintext—no hashing, no encryption, no obfuscation. This is a direct consequence of how stealer malware operates: it captures passwords exactly as they appear in browser password managers and autofill databases. For the 14,528 affected users, their accounts can be accessed by anyone who downloads this freely available file.

What Was Exposed

• Email Addresses — European user accounts spanning multiple online services
• Plaintext Passwords — credentials captured directly from infected browsers
• URLs — the exact login pages where each email-password pair was used

From One Stolen Password to Full Account Takeover

Credential stuffing attacks thrive on dumps like this. Automated tools take each of the 14,528 email-password pairs and systematically test them on popular services—banking portals, email providers, cloud storage, and social networks. Because many people use the same password everywhere, a single entry from this EU-focused dump can grant access to a victim's entire online footprint. The included URLs make targeting even more precise, showing attackers exactly which services to hit first.

The Malware Behind the Theft

The credentials in this dump were not obtained through a traditional server breach. Instead, infostealer malware was installed on thousands of individual computers—typically through phishing emails with malicious attachments, fake software update prompts, or compromised websites. Once active, the malware quietly extracted every saved login from Chrome, Firefox, Edge, and other browsers, then transmitted the data to collection servers. The threat actor professor66699 then compiled and shared these logs as a curated European combo list on Telegram.

Check If Your Credentials Were Exposed

European users who have ever encountered suspicious software behavior or unexpected login alerts should check their exposure immediately. HEROIC's breach scanner lets you search across more than 400 billion compromised records in seconds. Discover whether your email appears in the HQ EU Combo dump or any other known breach, and take action to change compromised passwords before they are weaponized.