Inside CPanel_Valid Stealer Logs: 3 Passwords Harvested

In April 2026, HEROIC's monitoring systems identified a stealer log file labeled CPanel_Valid on Telegram. The file contains 3 records, each pairing an email address with a plaintext password and the URL of a cPanel hosting control panel. cPanel credentials are among the most sensitive types of stolen logins because they provide server-level access—control over websites, databases, email accounts, DNS settings, and file systems.

Plaintext Passwords to Server Control Panels

The 3 passwords in this dump appear in plaintext, fully readable with no encryption or hashing. For standard user accounts, plaintext exposure is dangerous. For cPanel credentials, it is catastrophic. A single cPanel login in the wrong hands can give an attacker the ability to deface websites, install malware, intercept email, and exfiltrate databases—all without needing any additional exploits.

What Was Exposed

• Email Addresses — identifiers for cPanel administrative accounts
• Plaintext Passwords — unencrypted server access credentials
• URLs — direct links to cPanel login interfaces on hosting servers

Server Access Credentials Multiply Attack Surface

Unlike regular user account credentials, cPanel logins provide infrastructure-level access. Attackers who compromise a cPanel account can deploy backdoors, redirect domains, create rogue email accounts for phishing campaigns, and access every website hosted under that account. Additionally, these 3 credential pairs will be tested through credential stuffing against other services, exploiting any password reuse by the server administrators.

How Infostealers Target Server Administrators

The CPanel_Valid log was produced by infostealer malware running on infected devices belonging to web hosting administrators. The malware specifically targets browser-saved credentials for server management interfaces like cPanel, WHM, Plesk, and SSH clients. Once the credentials are harvested, they are packaged into categorized log files and distributed on Telegram, where they attract attackers specifically looking for server-level access credentials.

Check If Your Credentials Were Exposed

If you manage web hosting through cPanel, this leak demands immediate attention. HEROIC's breach scanner indexes over 400 billion compromised records. Search your email address or domain to determine if your credentials appeared in the CPanel_Valid dump or any other known breach. If exposed, change your cPanel password immediately, rotate all associated credentials, review server logs for unauthorized access, and enable two-factor authentication on your hosting panel.