Infected PC Owners Targeted: Logs_28 July Leaked 126,273 Passwords

HEROIC analysts identified a stealer log file named "Logs_28 July" uploaded to a Telegram channel on July 28, 2026. The log contains 126,273 records of email addresses, plaintext passwords, and the URLs of the sites those credentials were used on, all harvested directly from infected computers. Why This Is Dangerous: Stealer logs like this one come straight from malware running on a victim's own device. The malware quietly copies saved passwords and browser session data as people log into their accounts, then uploads everything to the attacker. Because the passwords are captured in plaintext, whoever gets this file can log into those accounts immediately. What Was Exposed: - Email addresses - Plaintext passwords - URLs of the sites the credentials belong to Why This Matters: Anyone whose device was infected when this log was collected is at risk of account takeover, since attackers now have working logins tied to specific sites. If those same passwords are reused elsewhere, the risk extends to banking, email, and social media accounts too, opening the door to identity theft and financial fraud well beyond the original infection. How a Stealer Log Like This Works: Infostealer malware infects a device through a malicious download, cracked software, or phishing link, then scans the browser for saved passwords, cookies, and autofill data. It packages everything by device and uploads it to the attacker, who often resells or shares the file on Telegram channels like the one this log surfaced on. Unlike a database breach, a stealer log reflects whatever was saved on that specific machine at the time of infection, which is why the data can span dozens of unrelated websites. Check If You Are Affected: HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including stealer logs like this one, so you can find out in seconds if your credentials were exposed.