IT 8.18 Stealer Log Quietly Exposes 60,368 Login Records

A Stealer Log Tagged "IT 8.18" Quietly Surfaces With 60,368 Records

On February 7, 2023, HEROIC analysts spotted a stealer log dataset shared by a Telegram user under the label "IT 8.18." There was no announcement or fanfare, the file simply appeared in circulation containing 60,368 records, each pairing an email address with a plaintext password and the URL of the site that login was used on.

Why This Stealer Log Is Dangerous

Quiet leaks like this one are often more dangerous than loud, headline-grabbing breaches, because they can sit unnoticed and be exploited long before anyone realizes their data is out. Every password here is in plaintext, meaning it can be used the moment someone opens the file. Paired with the exact URL tied to each account, there is no ambiguity about which site the credential unlocks.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs identifying the site each login was used on

Why This Matters

With 60,368 working email and password pairs, this dataset is a solid candidate for credential stuffing, where attackers test the same login across many other sites at once. If anyone in this batch reused a password, they are at real risk of account takeover on accounts that have nothing to do with the original leaked site. Because the file includes the exact URL, an attacker does not even need to guess where to try each login first.

How Stealer Logs Work

A stealer log comes from malware quietly running on an infected device, pulling saved passwords, autofill data, and browsing history before sending it all to the attacker controlling the malware. Common infection paths include pirated software, fake installers, and malicious attachments. Files like this one often circulate quietly on Telegram and dark web forums for a while before they are noticed, which is exactly why ongoing monitoring matters.

Check If You Are Affected

Quiet leaks like this one can go unnoticed for a long time, so it is worth checking your own exposure directly. HEROIC's free breach scanner searches a database of more than 400 billion leaked records, including stealer logs like this one, and shows you exactly what has surfaced so you can act before someone else does.