Inside the 198K UHQ Stealer Logs: PayPal and Zalando Targeted

HEROIC analyzed a stealer log collection labeled 198K UHQ for PayPal Zalando etc, uploaded to Telegram in January 2023, containing 198,395 compromised records. Unlike generic credential dumps, this collection was specifically curated to include logins for high-value financial and e-commerce platforms like PayPal and Zalando, making it particularly attractive to threat actors focused on financial fraud.

Plaintext Passwords for Financial Accounts Are Catastrophic

All 198,395 passwords in this collection are stored in plaintext — completely unencrypted and immediately exploitable. When those passwords belong to payment platforms like PayPal, the consequences are direct and financial. Attackers can log in, transfer funds, make purchases, or link new payment methods, all without needing to bypass any cryptographic protections.

What Was Exposed

• Email Addresses — account identifiers for PayPal, Zalando, and other major services
• Plaintext Passwords — unencrypted credentials harvested directly from browser sessions and password stores
• URLs — the exact login endpoints for PayPal, Zalando, and other targeted platforms

Financial Platform Credentials and Credential Stuffing

Credential stuffing attacks using this dataset are especially dangerous because the data includes URLs identifying which platforms each credential unlocks. Attackers do not need to guess — they know exactly which service each password works for. Automated tools can test these credentials at scale, and for financial services like PayPal, a single successful login can result in immediate monetary loss, unauthorized transactions, or complete account takeover.

How Infostealers Target E-Commerce and Payment Platforms

The malware behind this collection is designed to prioritize high-value targets. Modern infostealers are configured with lists of domains — PayPal, Zalando, banking sites — that trigger enhanced logging when detected. The malware captures not just credentials but also session cookies, autofill data, and two-factor authentication tokens. This data is then filtered and organized into curated collections like this one, specifically labeled as "UHQ" (ultra-high quality) to signal to buyers that the credentials target valuable services.

Check If Your Credentials Were Exposed

The 198K UHQ collection is fully indexed in the HEROIC data breach scanner. With over 400 billion records in its database, HEROIC can instantly determine whether your PayPal, Zalando, or other account credentials appear in this or any other known breach. Search now, change compromised passwords immediately — especially for financial accounts — and enable two-factor authentication on every platform that supports it.