Infected Device Owners Are the Target of KURZL0GS_UP’s 60,752 Logins

HEROIC analysts identified a stealer log called 2 JULY - KURZL0GS_UP 18K-PCS FRESH Part 2 uploaded to a Telegram channel on July 24, 2026. The file name references roughly 18,000 infected devices (PCs), and pulling data from that many machines produced 60,752 individual login records, since one infected device can yield credentials for several different accounts. Why This Is Dangerous: The people affected by this leak aren't customers of one hacked company, they are individuals whose personal devices were infected with malware. Anyone who downloaded a cracked program, a fake update, or an infected attachment around the time this log was compiled could be one of the 18,000 machines behind these 60,752 records. What Was Exposed: - Email addresses - Plaintext passwords - Endpoints and API hosts tied to each login Why This Matters: Because this data comes straight from infected browsers, it reflects real, recently used credentials rather than passwords tied to some distant, unrelated breach. Anyone whose device was compromised is now exposed to account takeover across every site their browser had saved a login for, from email to banking to social media, all through the same infection. How a Stealer Log Like This Works: Infostealer malware, once it lands on a device labeled fresh here because the infection is recent, quietly collects saved browser passwords, autofill data, and session tokens, then transmits everything back to the operator. Files like KURZL0GS_UP get split into parts and released in batches on Telegram as new devices get infected and new data comes in. Check If You Are Affected: If your device has ever run unfamiliar software, don't assume you're in the clear. HEROIC's free breach scanner checks your email against more than 400 billion leaked records, including stealer logs like this one, so you can see your exposure and change any at-risk passwords right away.