One Telegram Upload. 998 Records. The Logs_18 June Stealer Log.

One Telegram upload. 998 records. That is what HEROIC analysts found in a stealer log file named Logs_18 June, posted to a public Telegram channel on June 19, 2025. The file contains email addresses, plaintext passwords, and the URLs those credentials were used to log into.

Why This Is Dangerous

Every password in this log is stored in plaintext and matched to a specific URL, meaning an attacker can go straight from opening the file to logging into a victim's account, with no cracking or guessing required.

What Was Exposed in the Logs_18 June Stealer Log

• Email addresses tied to infected devices
• Plaintext passwords, stored with no encryption
• URLs showing exactly which sites and services each login belongs to

Why This Matters

Even a dataset of just 998 records can cause real harm, since the credentials inside are immediately usable. If any of the affected accounts share a password with an email provider, bank, or work login, the person behind it faces real risk of credential stuffing, account takeover, identity theft, or financial fraud.

How Stealer Logs Work

A stealer log is generated by malware that infects a device, often through a fake download, cracked software, or a malicious attachment. Once running, it quietly copies saved logins and browsing data out of the browser and sends everything back to the attacker. That information is bundled into a file, like Logs_18 June, and shared or sold through Telegram channels. Because the malware captures whatever is saved on the device at once, even a small file like this one can expose logins tied to several unrelated accounts.

Check If You Are Affected

If you are unsure whether your device has ever been infected with stealer malware, HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records. It takes seconds to see if you are exposed, so you know exactly which passwords to change.