How Malware Led to 631 Stolen Logins in the USA Dump

HEROIC's dark web surveillance uncovered a stealer log file titled "Fresh USA Domains" distributed through Telegram in November 2025. The file contains 631 records of stolen credentials tied to American domain users. Each record tells the same story: malware running silently on a victim's device captured their login credentials in real time and funneled the data to threat actors who packaged it for distribution.

Plaintext Passwords Offer Attackers Instant Access

The 631 passwords contained in this dump are all stored in plaintext. There is no cryptographic protection of any kind. Each password is fully readable and immediately usable by anyone who downloads the file. For affected users, this means their credentials are not hidden behind a hash that must be cracked. They are exposed in their exact original form, ready to be typed into any login page.

What Was Exposed

• Email Addresses — identifiers tied to USA-based domains, enabling targeted attacks on American users
• Plaintext Passwords — unencrypted login credentials captured directly from victims' browsers
• URLs — the specific websites and login portals where credentials were intercepted

From One Stolen Login to a Full Account Takeover

Credential stuffing is the natural next step after a dump like this surfaces. Attackers take the 631 email-password pairs and feed them into bots that automatically try each combination against major services such as Gmail, PayPal, Amazon, and banking platforms. The inclusion of URLs in this dataset is especially valuable to attackers because it tells them exactly which services the victim uses, allowing for highly targeted account takeover attempts rather than blind guessing.

The Malware Trail: How These Credentials Were Stolen

Every record in the Fresh USA Domains file started with a malware infection. Infostealer trojans typically arrive disguised as legitimate software, game cracks, or browser extensions. Once running on a victim's computer, the malware silently extracts saved passwords from Chrome, Firefox, Edge, and other browsers. It also captures login forms as they are filled out and steals session cookies that can bypass two-factor authentication. The harvested credentials are transmitted to command-and-control servers, sorted by region and domain, and eventually uploaded to Telegram as curated datasets like this one.

Check If Your Credentials Were Exposed

HEROIC's breach intelligence database spans over 400 billion records collected from data breaches, stealer logs, and dark web marketplaces around the world. Enter your email address into the HEROIC breach scanner to find out if your credentials appear in the Fresh USA Domains dump or any of the thousands of other breaches in the database. Discovering a compromised credential early is the first step toward preventing unauthorized access to your accounts.