The Logs_15 March Stealer Log Put 105,501 Stolen Passwords Online

HEROIC analysts found a stealer log dated March 15, 2025, uploaded to a public Telegram channel the following day, containing 105,501 records of email addresses, plaintext passwords, and the URLs and API hosts those logins connect to.

Why This Is Dangerous

The scale here matters. With over 100,000 records in plaintext, an attacker does not need to crack a single password, they can read every credential the moment they open the file. The inclusion of API host URLs alongside standard logins is notable too, since it means some of the exposed access points may lead directly into backend services rather than just consumer login pages, widening the potential damage beyond individual accounts.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs and API hosts tied to each login

Why This Matters

Any of the 105,501 people in this log who reused a password elsewhere are exposed to credential stuffing, where attackers automatically test stolen logins across banking, email, and shopping sites. A successful match leads directly to account takeover, and from there to identity theft or financial fraud. The presence of API endpoints in the data also raises the risk of attackers reaching connected services and accounts beyond the original breach.

How This Stealer Log Was Created

Infostealer malware infects a device, often through a malicious download or compromised software, and then quietly harvests every saved username, password, and browsing endpoint it can find. It packages that data, URLs and API hosts included, into a single log file and sends it back to the attacker. That log is then uploaded and shared, as it was here just one day after collection, on Telegram channels where it can be bought, sold, or used directly.

Check If You Are Affected

With 105,501 records in this log, the odds that your credentials are included are worth taking seriously. HEROIC's free breach scanner checks your email against more than 400 billion leaked records, including stealer logs like this one, so you can find out and secure your accounts before someone else gets there first.