Inside Mansory 9 Stealer Logs: 2,514,462 Passwords Taken

In December 2025, HEROIC detected the ninth installment in the Mansory stealer log series — Mansory 9 — shared on Telegram with a staggering 2,514,462 records. Each record pairs an email address with a plaintext password and the URL where the login was intercepted. The Mansory series has consistently produced some of the largest credential dumps tracked by HEROIC, and this volume continues that pattern with over 2.5 million compromised credentials.

2.5 Million Passwords in Plain View

Not a single password in Mansory 9 is encrypted or hashed. All 2,514,462 credentials are stored as readable plaintext, turning this file into one of the largest freely accessible repositories of working passwords in recent memory. At this scale, even automated defenses struggle to keep up — attackers can conduct credential stuffing campaigns that test millions of login combinations per hour, overwhelming rate limits and security monitoring.

What Was Exposed

• Email addresses spanning personal, corporate, and government domains
• Plaintext passwords harvested directly from browser storage and keystroke capture
• URLs documenting the exact websites and applications where each credential was used

Industrial-Scale Credential Stuffing

With 2,514,462 credential pairs, Mansory 9 enables credential stuffing at an industrial scale. Attackers deploy botnets and distributed tools to test these pairs against every major platform simultaneously. The sheer volume means that even a low success rate of one or two percent yields tens of thousands of compromised accounts. Banks, healthcare portals, government services, and corporate systems all become targets. The downstream impact includes wire fraud, medical identity theft, and corporate espionage.

The Mansory Series: A Persistent Threat Operation

Mansory 9 is the ninth known release from this operator, indicating a well-established and ongoing credential harvesting operation. The underlying infrastructure relies on infostealer malware — tools like RedLine, Lumma, Stealc, and Vidar — deployed through phishing campaigns, malicious software bundles, and compromised browser extensions. Each volume in the Mansory series represents a new batch of harvested data from freshly infected machines, ensuring a continuous flow of current credentials into the criminal marketplace.

Check If Your Credentials Were Exposed

With over 2.5 million records, Mansory 9 is one of the most significant stealer log releases of 2025. HEROIC's breach scanner indexes more than 400 billion compromised records, giving you the ability to search your email address across the entire known breach landscape. Check now to see if your credentials appear in Mansory 9 or any other breach, then take immediate steps: change all potentially compromised passwords, deploy a password manager, and enable multi-factor authentication on every account that supports it.