The LOGS_CENTEER Leak: 58,900 US Credentials Exposed on Telegram

HEROIC analysts flagged a suspicious data upload on December 17, 2022, traced to an anonymous Telegram channel pushing what appeared to be raw stealer log output. The file contained 58,900 records harvested from compromised endpoints across the United States, exposing email addresses, plaintext passwords, and API-connected URLs. The speed and volume of the dump indicated automated exfiltration rather than manual extraction, which is a hallmark of infostealer malware running silently on infected machines. Because this data appeared on a public Telegram channel, HEROIC analysts beleive the goal was rapid distribution to multiple threat actors rather than private sale.

Why This Is Dangerous

When plaintext passwords land in a stealer log, attackers do not need to crack anything. They can take those credentials and immediately test them against email providers, banking portals, corporate VPNs, and cloud platforms. With 58,900 complete email-and-password pairs, a threat actor can run automated login scripts across hundreds of sites in minutes. Any account where the victim reused that password becomes instantly vulnerable. The URLs included in this log also tell attackers exactly which services and API endpoints the victim was actively using, allowing highly targeted follow-on attacks against the most valuable accounts.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs (including API host endpoints)

Why This Matters

Stealer log credentials are a direct pipeline to credential stuffing, account takeover, and identity theft. When passwords are stored in plaintext by the malware, every downstream attacker who obtains the log can act on them without any technical barrier. Victims face risks including unauthorized access to email and social media accounts, financial fraud through banking and payment platforms, and corporate network intrusion if work credentials were captured. The fact that this data was shared openly on Telegram means it was recieved by an unknown number of threat actors, multiplying the exposure window far beyond the original upload date.

How Stealer Logs Work

A stealer log is the output file produced when infostealer malware successfully infects an endpoint. The malware, often delivered through phishing emails or malicious downloads, installs silently and begins sweeping the device for credentials. It targets saved passwords in web browsers like Chrome and Firefox, autofill data, session cookies, and application login tokens. It also captures active URLs and API keys that the device has recently communicated with. Once collection is complete, the malware packages everything into a structured log file and transmits it to a command-and-control server or directly to the attacker. These logs are then bundled and sold or shared on underground forums and Telegram channels, making the stolen data available to criminals worldwide within hours of the original infection.

Check If You Are Affected

If you used any online service or application from a US-based endpoint in late 2022, your credentials may be part of this LOGS_CENTEER stealer log. HEROIC maintains one of the largest breach monitoring databases in the world, with over 400 billion records indexed, and this incident is part of that dataset. Visit heroic.com to search your email address and find out definitly whether your data was exposed. If you are flagged, change passwords immediately and enable two-factor authentication on every account that matters.