Researchers Link LOGS_CENTER 4 Telegram Dump to 22,386 Stolen Credentials

HEROIC analysts traced the LOGS_CENTER 4 dataset to a public Telegram channel where an anonymous user uploaded the stealer log file on July 5th, 2023. The dataset contained 22,386 records pulled from infected endpoints, with each record including an email address, a plaintext password, and a URL identifying the login page or API host involved. The volume and structure of the data are consistent with a coordinated infostealer campaign targeting end users across multiple platforms.

Why This Is Dangerous

The LOGS_CENTER 4 file gave anyone who downloaded it from Telegram an instant arsenal of working login credentials. The passwords are not hashed, encrypted, or otherwise protected. An attacker can paste them directly into credential stuffing tools and begin testing them against email providers, online banks, retailer accounts, and social media platforms within minutes of downloading the file. With 22,386 records and a high likelihood of password reuse among those affected, the potential for widespread account compromise is significant.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs (login pages and API hosts)

Why This Matters

Credential stuffing has become one of the most common and damaging forms of cybercrime because it requires almost no technical skill. Stolen login pairs from a stealer log like LOGS_CENTER 4 can be fed into freely available automation tools that test thousands of accounts per minute. Successful logins give attackers access to everything tied to those accounts, from financal records and stored payment methods to personal communications and connected services. Identity theft, financial fraud, and account takeover all become possible the moment this data lands in the wrong hands.

How Stealer Logs Work

Researchers have documented a steady rise in infostealer deployments over the past several years. These programs infiltrate devices through social engineering tactics such as fake software installers, trojanized browser extensions, and phishing emails with malicious attachments. Once installed, the malware runs silently and harvests saved credentials, session tokens, and browsing data. The collected records are then transmitted to command and control servers, where they are packaged into log files and distributed through underground marketplaces or Telegram channels for use by a broad range of threat actors.

Check If You Are Affected

If your email address appeared in the LOGS_CENTER 4 dataset or any other breach tracked by HEROIC, you deserve to know about it. HEROIC's free identity scanner searches more than 400 billion exposed records, including stealer logs, dark web dumps, and hacked databases from around the world. Run your scan now to see if your credentials have been compromised and get guidance on what to do next.