The KURZL0GS Part 147 Dump Contains Exactly 302,999 Email and Password Pairs

HEROIC analysts identified a stealer log dataset uploaded by a Telegram user in February 2026 that exposed 302,999 records. The file, labeled KURZL0GS - FRESH ULP NEW 08-02-2026.txt_part_147, is another segment in the multi-part KURZL0GS stealer log distribution series. It contained email addresses, plaintext passwords, and URLs captured from compromised endpoint devices and was distributed through underground Telegram channels as part of the broader KURZL0GS credential sharing operation.

Why the KURZL0GS Part 147 Stealer Log Is an Active Threat to Account Security

The 302,999 records in this file are not theoretical exposure -- they represent active attack materials in the hands of cybercriminals. Each record contains a plaintext password, an email address, and the exact URL where that credential was captured and is known to function. This ULP format requires no additional work from attackers. The FRESH label on this file signals to buyers that the credentials are recently collected and likely unchanged, meaning victims have not yet had the opportunity to protect themselves. The risk window for stealer log data is immediat and narrows only when affected users change their passwords.

Data Exposed in the KURZL0GS FRESH ULP Part 147 Stealer Log

The following data was confirmed present in this breach segment:

• Email Addresses -- account identifiers and recovery contacts linking victims to every connected online service
• Plaintext Passwords -- unencrypted login credentials captured live from victim devices, usable without any additional processing
• URLs -- the specific websites and services where each credential was stolen and confirmed valid

Credential Stuffing, Account Takeover, Identity Theft, and Financial Fraud Risks

The operational value of the KURZL0GS Part 147 dataset enables multiple attack types:

• Credential stuffing -- automated attack tools test the 302,999 email and password pairs against major platforms within hours of the file changing hands
• Account takeover -- URL-specific data means attackers target the exact right service without any trial and error
• Identity theft -- compromised email accounts become a pivot point for resetting passwords and intercepting two-factor codes on every linked account
• Financial fraud -- financial service URLs in the dataset provide direct access to banking accounts and payment platforms
• Resale compounding -- validated credentials from part 147 are resold independantly, extending victimization beyond the initial breach event

The Mechanics Behind KURZL0GS Part 147 and the Full Stealer Log Series

KURZL0GS is a structured infostealer log distribution operation on Telegram that packages credentials into uniform, numbered part files. Part 147 contains 302,999 records -- consistent with the batch sizing used across the series. These logs are generated by infostealer malware that infiltrates victim devices through phishing campaigns, cracked software, and malicious browser extensions. Once installed, the malware operates silently, recording login events, extracting browser-saved passwords, and capturing associated URLs. The data is then consolidated, batched by the operator, and uploaded in numbered parts to Telegram for sale and free distribution. The systematic numbering and consistent batch sizes in the KURZL0GS series indicate an organized operation with ongoing data collection rather than a one-time event. Each new part uploaded represents fresh infections and newly stolen credentials from real users around the world. The February 2026 date confirms this data is recent and many accounts may still be vulernable to takeover.

Check If Your Credentials Appear in the KURZL0GS Part 147 Breach

HEROIC's free breach scanner searches your email address against more than 400 billion compromised records, including the full KURZL0GS stealer log series. If your credentials appeared in part 147 or any related part of KURZL0GS, you will receive immediate results and can change passwords before attackers exploit them. Scan for free at heroic.com and protect every account associated with your email address.