Inside USA PVT Base Stealer Logs: 18,160 Passwords Harvested

HEROIC's threat intelligence operations uncovered a stealer log collection labeled 18k USA PVT Base being distributed on Telegram. Appearing in February 2023, this privately circulated dataset contains 18,160 records specifically targeting American users, with email addresses, plaintext passwords, and the URLs of services where the credentials were captured by infostealer malware.

The Technical Reality of Plaintext Password Exposure

All 18,160 credentials in this dump are stored in raw plaintext format. From a technical standpoint, this is the worst possible outcome for affected users. There is no bcrypt hash to slow down attackers, no salting to complicate rainbow table attacks—just the original password strings ready for direct use. Automated attack frameworks can ingest these credentials and begin testing them against live services in under a minute.

What Was Exposed

• Email Addresses — US-based personal and business email accounts
• Plaintext Passwords — unprocessed credential strings exactly as stored in browsers
• URLs — login endpoints for banking, email, retail, and enterprise services

Credential Reuse Turns One Breach into Many

The "PVT" (private) designation in this dump's name suggests it was initially restricted to a small group of threat actors before wider distribution. Credential stuffing tools like SentryMBA and OpenBullet can process these 18,160 pairs against target lists of thousands of websites. For US users who share the same password between their personal email and their bank, or between a social media account and a work VPN, this leak represents a direct path to account compromise across multiple services.

Stealer Log Architecture: From Infection to Distribution

The 18k USA PVT Base data was extracted by infostealer trojans that operate on a straightforward technical pipeline. Malware like RedLine or Stealc hooks into browser credential storage APIs, reads the SQLite databases where Chrome, Firefox, and Edge store passwords, and decrypts them using the victim's own Windows DPAPI keys. The malware then packages these credentials alongside cookies and system fingerprint data into structured log files. These logs pass through aggregation channels before being organized by geography and distributed on Telegram.

Check If Your Credentials Were Exposed

HEROIC's breach intelligence platform indexes over 400 billion records from data breaches, stealer logs, and dark web leaks. Use HEROIC's free breach scanner to check whether your email or credentials appear in the 18k USA PVT Base dump or any other compromised dataset. If you find a match, change the exposed password immediately, ensure you are not reusing it elsewhere, and enable two-factor authentication on all accounts—especially financial and email services.