The JohnDoeProject Stealer Log: 80,000 Plaintext Passwords Exposed

HEROIC analysts identified a stealer log upload on Telegram in late August 2025 that exposed 80,066 records tied to something called JohnDoeProject. The data was discoverd on August 28, 2025, and includes email addresses, plaintext passwords, and URLs. Unlike large-scale corporate breaches that sweep up millions of random users, this log appears to target a specific project environment, which means every exposed record carries a concentrated risk. The fact that passwords were stored and transmited in plaintext makes this particularly dangerous for anyone whose credentials appeared in the dump.

Why This Is Dangerous

Stealer logs are created by malware that silently runs on infected computers, harvesting everything it can find: saved browser passwords, autofill data, session cookies, and login credentials. Once that data is packaged into a log file and shared on Telegram, it becomes instantly accessible to thousands of bad actors. In this case, the plaintext nature of the passwords means there is no cracking required. Anyone who downloads the file gets working credentials they can try on email accounts, banking apps, and any other service where the victim reused their password. This is not a theoretical risk. It is a live, usable dataset in the hands of cybercriminals.

What Was Exposed

• Email addresses
• Plaintext passwords (no encryption, no hashing)
• URLs associated with project endpoints and API hosts
• 80,066 total records from the JohnDoeProject environment

Why This Matters

Most people reuse passwords across multiple accounts. That habit turns a single stealer log into a skeleton key. With a working email and plaintext password, an attacker can attempt credential stuffing attacks across dozens of popular platforms in minutes. The inclusion of API host URLs also suggests that developer or service credentials may be in the mix, which could open doors to backend systems, cloud infrastracture, or third-party integrations. Even if you were not directly part of JohnDoeProject, if your email appears in this log from a shared tool or collaboration platform, your account is at risk.

How Stealer Log Attacks Work

Stealer malware typically arrives through phishing emails, fake software downloads, or malicious browser extensions. Once installed on a device, it runs quietly in the background, scanning for saved credentials in browsers, desktop apps, and configuration files. The harvested data is bundled into a structured log file and sent back to whoever controls the malware, or sold directly to other criminals. Telegram has become a preferred distribution channel because it allows sellers to share samples, take orders, and deliver files all within the same platform, with minimal traceability. The JohnDoeProject log followed this exact pattern: uploaded, shared, and now circulating among threat actors.

Check If You Are Affected

If you think your email or credentials may have appeared in this stealer log, the fastest way to find out is to run a free search on HEROIC's breach scanner. HEROIC monitors over 400 billion breached records, including stealer log data from Telegram and dark web sources. Enter your email address and see instantly whether your information has been compromised in this breach or any other. Taking 30 seconds to check now could save you from account takeovers, identity theft, or worse down the road.