Inside Good2 Stealer Logs: 3,030 Passwords Harvested

HEROIC analysts identified a stealer log file titled "Good2" that appeared on Telegram in May 2026. The dump contained 3,030 compromised records, each consisting of an email address, a plaintext password, and a URL linking the credential to a specific login page. The naming convention suggests this is the second iteration of a recurring dump series from the same threat actor, indicating an ongoing credential harvesting operation.

Why Plaintext Passwords from Recurring Dumps Signal Persistent Threats

When a stealer log appears as part of a numbered series, it indicates the threat actor has an established pipeline for harvesting and distributing credentials. The "Good2" label suggests a previous "Good" or "Good1" dump existed, meaning the same operator is continuously collecting new victim data.

Plaintext passwords in these recurring dumps are immediately usable. There is no hashing or encryption to slow down attackers, and the ongoing nature of the operation means fresh credentials are constantly entering circulation.

Victims who appeared in earlier dumps from the same operator may find their updated or new passwords captured again if they did not address the underlying malware infection on their device. Simply changing a password without removing the infostealer leaves the new credentials equally vulnerable.

What Was Exposed in the Good2 Dump

• Email Addresses — Email addresses from various providers and services
• Plaintext Passwords — Unencrypted passwords captured directly from victim browsers
• URLs — Login pages revealing which services each victim accessed

Why 3,030 Credentials from a Series Dump Multiply the Danger

Each record in this dump represents a real person whose credentials were silently stolen. When combined with previous dumps in the same series, the total number of compromised accounts grows substantially. Threat actors who maintain ongoing operations accumulate thousands of credentials over time.

Credential stuffing tools can process all 3,030 entries rapidly, testing each email-password pair against banking sites, social media platforms, email providers, and enterprise applications. The URLs included in the dump provide attackers with confirmed starting points, but the real damage comes from testing the same credentials across other services.

Underground buyers specifically seek out dumps from active operators because the credentials are more likely to be current and working. A series like Good2 signals reliability and freshness, commanding higher prices in criminal marketplaces.

How Stealer Logs from Active Operations Work

Infostealer malware such as RedLine, Raccoon, and Vidar operates as a service model. Threat actors purchase or rent access to malware builders, distribute the malware through phishing campaigns and malicious downloads, and collect credentials from infected devices through centralized command-and-control servers.

Active operators continuously process incoming stealer logs, organizing them into batches for distribution. Each new batch receives a sequential label, creating series like "Good," "Good2," and so on. This assembly-line approach ensures a steady supply of fresh credentials for underground markets.

The malware itself runs silently on infected devices, extracting passwords from Chrome, Firefox, Edge, and other browsers. It also captures autofill data, cookies, and cryptocurrency wallet information, making each infection a comprehensive data harvesting event.

Check If Your Credentials Were Exposed

If you have ever saved passwords in your web browser, your credentials could appear in the Good2 dump or any of the related releases in this series. The ongoing nature of this operation means new victims are being added continuously, making regular credential monitoring essential.

Use the HEROIC data breach scanner to search across more than 400 billion compromised records. Enter your email address to check whether your credentials appeared in this dump or any other known breach, and take immediate steps to change passwords and enable multi-factor authentication on all of your accounts.