Inside Gmail New Part 30 Stealer Logs: 180,538 Passwords

HEROIC's threat intelligence team identified a large stealer log dump titled "Gmail New Part 30" circulating on Telegram since January 2023. This file—part of a broader series targeting Gmail accounts—contains 180,538 credential records extracted from infected devices by infostealer malware. Each record includes an email address, a plaintext password, and the URL where the credentials were entered.

Plaintext Passwords: No Technical Barrier to Account Takeover

Every one of the 180,538 passwords in this dump is stored in cleartext. There is no hashing algorithm to reverse, no encryption key to obtain. Attackers can read each password as easily as you are reading this text, making these credentials immediately weaponizable against the associated Gmail accounts and any other service that shares the same password.

What Was Exposed

• Email Addresses – Gmail accounts that serve as primary identifiers across Google's ecosystem and third-party services
• Plaintext Passwords – Cleartext credentials extracted directly from browser password stores
• URLs – Login endpoints revealing which specific services were accessed with these credentials

Credential Stuffing at Scale: 180,538 Attack Vectors

A dump of this size provides attackers with a massive arsenal for automated credential stuffing campaigns. Each email-password pair is tested against banking platforms, e-commerce sites, cloud services, and corporate portals. Gmail accounts are especially valuable because they often serve as recovery addresses for other services—compromising one Gmail account can cascade into control over an entire digital identity.

The Technical Anatomy of a Stealer Log Infection

Stealer logs are produced by infostealer trojans—malware families like RedLine, Raccoon, and Lumma that target browser credential stores. The infection chain typically begins with a malicious download: cracked software, a fake update prompt, or a weaponized email attachment. Once executed, the stealer enumerates installed browsers, decrypts locally stored passwords using the operating system's credential API, captures active session cookies, and exfiltrates the data to a command-and-control server. The stolen records are then packaged into structured log files and distributed through Telegram.

Check If Your Credentials Were Exposed

With over 180,000 Gmail-focused credentials in this single dump, the risk is substantial. HEROIC's breach scanner indexes more than 400 billion compromised records sourced from breaches, stealer logs, and dark web markets. Enter your email address to determine whether your credentials appear in the Gmail New Part 30 dump or in any other breach in the HEROIC database.