How Malware Led to 15,965 Stolen Logins in the Deifohc5 Dump

HEROIC traced a stealer log file labeled Mixed Good Email Combo Deifohc5, uploaded to Telegram in March 2025, to a series of infostealer infections that compromised 15,965 users. Behind every record is the same pattern: a person downloaded something they trusted, malware silently activated, and from that moment, every password they typed and every website they visited was recorded and exfiltrated to attackers.

Why Plaintext Passwords Demand Immediate Action

The 15,965 passwords in this dump are stored in plaintext, meaning they were captured exactly as users typed them. There is no scrambling, no hashing, and no time-consuming decryption process for attackers. The moment someone accesses this file, every credential inside is ready for immediate use — a direct line from the Telegram post to your account login screen.

What Was Exposed

• Email Addresses — mixed provider accounts spanning Gmail, Outlook, Yahoo, and others
• Plaintext Passwords — verbatim passwords as captured by malware during real login sessions
• URLs — the websites victims were accessing, mapping their online activity for attackers

The Credential Stuffing Cascade

With 15,965 email-and-password pairs from mixed providers, attackers have a diverse toolkit for credential stuffing. Each pair is tested against financial institutions, online retailers, streaming services, and enterprise platforms. The mixed nature of this collection is strategically valuable — it gives attackers credentials spanning multiple email providers, increasing the odds that at least some victims reuse passwords across services and can be fully compromised.

From Infection to Telegram: How the Data Got Here

The story of each stolen credential begins identically. A user clicks on a malicious link, opens a weaponized document, or installs trojanized software. Infostealer malware deploys silently, embedding itself in the operating system. It begins extracting credentials from browser password stores, capturing keystrokes during active login sessions, and harvesting authentication cookies that maintain active sessions. The data streams to a command-and-control server, where it is organized into log files, bundled into collections like Deifohc5, and uploaded to Telegram for widespread distribution.

Check If Your Credentials Were Exposed

The Mixed Good Email Combo Deifohc5 collection is now searchable through the HEROIC data breach scanner. With over 400 billion records indexed from thousands of breaches worldwide, HEROIC can confirm in seconds whether your email or password was compromised. Search today, replace any exposed passwords with unique ones for each service, and enable two-factor authentication to add a layer of protection that stolen passwords alone cannot bypass.