How Malware Led to 4,998 Stolen Logins in the ABV.BG Dump

HEROIC uncovered a stealer log file titled ABV.BG 5K Full Valid on Telegram that exposes 4,998 compromised records targeting users of ABV.BG, Bulgaria's largest email provider. The malware-harvested data includes email addresses paired with plaintext passwords and the URLs where those credentials were originally entered.

The Real Cost of Plaintext Password Leaks

When passwords are exposed in plaintext, every layer of protection is stripped away. Attackers need no technical skill to exploit them. They simply read the password and log in. For nearly 5,000 ABV.BG users in this dump, their email accounts, and any services linked to those email addresses, are at immediate risk of unauthorized access.

What Was Exposed

• Email addresses from ABV.BG, Bulgaria's primary email platform
• Plaintext passwords extracted from infected devices
• URLs showing which websites the credentials were used on

Credential Stuffing Turns One Stolen Login into a Full Takeover

Attackers rarely stop at one account. Using automated credential stuffing tools, they test each leaked email-password pair against banking sites, social media, cloud storage, and government portals. Since many users rely on their ABV.BG email as a recovery address for other services, a single compromised password can unlock an entire chain of accounts.

The Journey from Malware Infection to Telegram Leak

Infostealer malware typically reaches victims through infected email attachments, malicious ads, or pirated software downloads. Once running on a device, it quietly extracts every credential stored in the browser, captures form data, and records session cookies. The stolen data is compiled into stealer logs and uploaded to Telegram channels where it becomes publicly available.

Check If Your Credentials Were Exposed

If you use an ABV.BG email address, you may be among the 4,998 users affected. Enter your email into the HEROIC breach scanner to search across more than 400 billion compromised records and find out if your credentials have been exposed. Identifying the breach early is the most effective way to protect your accounts from takeover.