How Malware Led to 30,906 Stolen Logins in the Unknown 3 Dump

HEROIC's threat intelligence team identified a stealer log collection labeled "Unknown 3" that appeared on underground channels in February 2023. The file contains 30,906 records extracted by malware from compromised computers and devices. Each record tells a story of compromise: an email address paired with its plaintext password and the URL of the website where the victim was logged in when the malware captured their credentials.

Plaintext Passwords Are an Open Invitation

Every one of the 30,906 passwords in this dump is in plaintext — completely unencrypted and readable at a glance. Attackers do not need to invest time or resources cracking hashes. They simply open the file, pick a credential, and start logging into accounts. This makes the Unknown 3 dump exceptionally dangerous for anyone whose credentials appear in it.

What Was Exposed

• Email Addresses — account identifiers used for login and targeted phishing attacks
• Plaintext Passwords — unprotected credentials that can be used instantly
• URLs — the websites and web applications where credentials were actively harvested

From One Breach to Many: The Credential Stuffing Chain

Over 30,000 email-password pairs give attackers significant ammunition for credential stuffing campaigns. These automated attacks test every stolen combination against popular services including email providers, financial institutions, streaming platforms, and online retailers. The math is simple but devastating: if even a fraction of these users reused their passwords, thousands of additional accounts beyond this dump are now accessible to criminals.

The Malware That Made This Possible

Infostealer malware is the tool that created the Unknown 3 dataset. These programs embed themselves in victims' systems through deceptive downloads, trojanized applications, or phishing links. Once installed, the malware methodically extracts stored credentials from every browser on the device, captures form data as it is entered, and siphons session tokens that can bypass two-factor authentication. All of this harvested data is then packaged into organized log files and distributed through underground networks.

Check If Your Credentials Were Exposed

HEROIC monitors the dark web and maintains a database of over 400 billion compromised records from thousands of breaches and stealer log collections. Use HEROIC's breach scanner to search your email address and find out if your credentials appeared in the Unknown 3 dump. If they did, change your passwords immediately and enable two-factor authentication on all critical accounts.