Inside the Good Emails.txt_Australia 180 Log: 175 Passwords Leaked

In May 2026, HEROIC analysts identified a stealer log file, uploaded to a Telegram channel under the label "Good emails.txt_Australia 180 uploaded by a Telegram User." The file is dated 28-May-2026 and contains 175 individual records pulled directly from malware-infected devices, including email addresses, plaintext passwords, and the URLs of the accounts those credentials unlock. While 175 records is a small batch compared to some breaches, each one is a fully working login pair. Why This Is Dangerous: Unlike a typical database leak, this data comes straight from infected computers. Each of the 175 records is a working, ready-to-use login pair: an email address, its matching plaintext password, and the exact website it belongs to. An attacker does not need to guess or crack anything. They can open the listed URL, enter the credentials, and be logged in immediately, whether that account is an email inbox, a shopping account, or a work login. What Was Exposed in This Stealer Log: The file contains email addresses, plaintext passwords, and the URLs of the sites the credentials belong to. Why This Matters: Because the passwords in this file were stored in plaintext, meaning unencrypted and fully readable, anyone who obtains the log can use the credentials immediately. If any of the 175 affected logins are reused across other accounts, such as email, banking, or social media, attackers can attempt credential stuffing to break into those accounts too. Even a small file like this one can lead to account takeover, financial fraud, or identity theft for the people whose data it contains. How This Stealer Log Was Created: Stealer logs like this one come from information-stealing malware that infects a victim's device, often through a fake download, cracked software, or a malicious email attachment. Once installed, the malware quietly scans the browser for saved passwords, autofill data, and active login sessions, then packages everything into a single file. Criminals often trade or dump smaller files like this one, containing only a few hundred records, on Telegram channels to build reputation or test buyer interest before selling larger collections. The result here is a compact file with 175 ready-to-use email, password, and URL combinations. Check If You Are Affected: If you think your email or an account you use may be part of this stealer log or any other breach, you can check for free using HEROIC's breach scanner. It searches across a database of more than 400 billion leaked records to show you if your information has been exposed, so you can change any reused passwords before someone else uses them first.