Inside EXPERTLOGS REBORN1769: How Malware Harvested 81,566 Passwords

Inside EXPERTLOGS REBORN1769: 81,566 Records Harvested by Malware

HEROIC analysts traced a stealer log labeled "EXPERTLOGS REBORN1769 GAME SOCIAL DIARY" back to a public Telegram channel where it surfaced on January 6, 2024. The file contained 81,566 records, including email addresses, plaintext passwords, and the API host URLs tied to each account, with most records linked to users in the United States.

Why This Is Dangerous

Because the passwords were captured in plaintext directly off infected devices, they work immediately, with no cracking required. Combined with the API host URLs for each account, this dataset gives an attacker both the key and the door it opens, making it possible to automate logins against real services rather than guessing where stolen credentials might work.

What Was Exposed

• Email addresses
• Plaintext passwords
• API host URLs

Why This Matters

A dataset of this size, over 81,000 records, gives attackers plenty of raw material for credential stuffing campaigns that test stolen logins across banking, email, and social media platforms. Anyone who reused one of these passwords elsewhere faces a real risk of account takeover, and from there, identity theft or financial fraud if the compromised account is linked to payment information.

How Malware Harvested These 81,566 Records

Logs like EXPERTLOGS REBORN1769 come from infostealer malware, programs that infect a device, often through a pirated game, cracked software, or a malicious download, and quietly copy every saved password, cookie, and autofill entry they find. The malware bundles the results into a single log file and sends it back to whoever is running it. From there, logs are renamed, organized, and uploaded to Telegram channels and dark web forums where anyone can download them for free.

Check If You Are Affected

There is no way to know just by looking whether your email address is part of a stealer log like this one. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including logs like EXPERTLOGS REBORN1769, and tells you immediately if your credentials have been exposed. Run a scan now and change any password that comes back compromised.