Inside the 565k AOL Base Stealer Logs: 227,449 Passwords

HEROIC identified a substantial credential dump labeled 565k AOL Base being distributed through Telegram channels. The file targets AOL email account holders and contains 227,449 unique records. Each record pairs an AOL email address with its plaintext password and the URL of the service where the credential was intercepted by infostealer malware. AOL accounts are particularly vulnerable targets because many users have maintained the same passwords for years.

Plaintext Passwords on a Massive Scale

All 227,449 passwords in this AOL-focused dump are in raw plaintext. There is no hashing, salting, or encryption protecting these credentials. The scale of this exposure is significant — hundreds of thousands of AOL users now have their login details available to anyone who downloads this file. Legacy email providers like AOL are frequently targeted because their users tend to have older, less secure password habits and may not have enabled modern security features.

What Was Exposed

• Email Addresses — AOL accounts that often serve as primary email and account recovery addresses
• Plaintext Passwords — unprotected credentials for direct, immediate account access
• URLs — websites and services linked to each compromised AOL credential

AOL Accounts as Keys to Your Digital Life

Many AOL email addresses were created decades ago and are still used as recovery addresses for newer accounts. When attackers compromise an AOL account, they can initiate password resets on connected services — banking, shopping, healthcare portals, and social media. Credential stuffing tools test each AOL password against these platforms automatically. The 227,449 email-password pairs in this dump will be weaponized across the entire internet.

Technical Analysis: Infostealer Data Collection

The 565k AOL Base was compiled from credentials extracted by infostealer malware families such as RedLine, Raccoon, and Vidar. These trojans target the credential storage mechanisms in popular browsers — specifically the Login Data SQLite database in Chromium-based browsers and the logins.json file in Firefox. After decrypting stored credentials using operating system APIs, the malware exfiltrates the data to remote servers. The stolen credentials are then sorted by email domain, with AOL addresses compiled into targeted datasets like this one.

Check If Your Credentials Were Exposed

Every record from the 565k AOL Base has been indexed in HEROIC's breach database, which encompasses over 400 billion compromised credentials. Use HEROIC's free breach scanner to check if your AOL email address or password is in this dump. If your credentials appear, change your AOL password immediately, review all accounts that use your AOL address for recovery, and activate two-factor authentication wherever available.