How Malware Led to 98,287 Stolen WordPress Logins

HEROIC discovered a stealer log simply titled WordPress on Telegram in June 2026. The file exposes 98,287 records, each one containing the email address, plaintext password, and URL of a WordPress site where the login was stolen. This leak tells the story of how infostealer malware quietly siphoned credentials from tens of thousands of website owners and users.

Plaintext Passwords Put Entire Websites at Risk

Every credential in this dataset is stored in plaintext, completely unprotected. When WordPress admin passwords leak in this state, attackers gain the ability to take over not just individual accounts but entire websites. No brute forcing or hash cracking is necessary; the passwords work immediately as-is.

What Was Exposed

• Email addresses tied to WordPress administrator and user accounts
• Plaintext passwords exposed in fully readable text
• URLs of WordPress sites revealing the exact targets for account takeover

Credential Reuse Spreads the Damage Beyond WordPress

Website administrators who use the same password for their WordPress dashboard and their personal email, hosting provider, or domain registrar are especially vulnerable. Credential stuffing attacks take each leaked pair and test it across many services. With 98,287 records, attackers have a substantial list to work through, and every password match can unravel access to an entire ecosystem of connected accounts and services.

Tracing the Path From Infection to Stealer Log

The credentials in this file were captured by infostealer malware that infected individual computers. When a website administrator saved their WordPress login in a browser, the malware extracted it along with every other stored credential. The collected data was then packaged into a log file and posted to Telegram, where it became freely available to anyone looking to compromise WordPress sites.

Check If Your Credentials Were Exposed

WordPress administrators and users should treat this leak seriously. HEROIC's breach scanner searches more than 400 billion compromised records to help you determine whether your email or password has been exposed in this or any other breach. Check now, change compromised passwords, and consider adding two-factor authentication to your WordPress sites.