Inside the JohnDoeProject Stealer Log: 26,286 Passwords Harvested

HEROIC analysts found a stealer log file, branded "JohnDoeProject," uploaded to a public Telegram channel on November 9, 2025. The file contained 26,286 records harvested directly from infected devices, pairing email addresses with plaintext passwords and the URLs of the login pages they unlock.

Why the JohnDoeProject Leak Is Dangerous

Because the passwords in this file are stored in plaintext and matched directly to the URL each one unlocks, no cracking is needed. Anyone who downloads this log can pick a record, open the listed URL, and log in with the exact email and password shown, giving them immediate access to that account.

What Was Exposed in the JohnDoeProject Leak

• Email addresses
• Plaintext passwords
• URLs of the associated login pages

All 26,286 records came from the same malware infection event dated November 9, 2025.

Why This Matters if You Are in the File

A ready-to-use login skips every step an attacker would normally need to take. If that password is reused anywhere else, the exposure spreads through credential stuffing across email, banking, or shopping accounts, which can lead to account takeover, identity theft, or financial fraud.

Inside How a Stealer Log Like JohnDoeProject Gets Made

A stealer log is the direct output of infostealer malware that infects a device, typically through a phishing link, a cracked software download, or a malicious attachment. Once running on a machine, it quietly copies saved browser passwords and the URLs tied to each login, session by session, and bundles everything into a single log file. That file, exactly like this JohnDoeProject dump, is then uploaded to a Telegram channel where it can be downloaded and used immediately.

Check If You Are Affected by This Leak

If you want to know whether your email or passwords appear in this or any other stealer log, HEROIC's free breach scanner checks your information against a database of more than 400 billion leaked records. Run a free scan and change any passwords you have reused elsewhere.