Everyday Internet Users Targeted in the 12,583 Record LOGS_CENTER Stealer Log Leak

HEROIC analysts found a stealer log file on June 15th, 2023, uploaded to a public Telegram channel by an anonymous user. The file, identified as 6.15 - LOGS_CENTER, contained 12,583 records collected from infected endpoints. The data covered email addresses, plaintext passwords, and URLs that pointed to services and applications the affected users had been accessing. Whoever was running the devices that got infected had no way of knowing their credentials were being sent somewhere else in the background.

Why This Is Dangerous

Credentials exposed in plaintext are ready to use without any extra work on the attacker's side. Someone with this file can attempt to log into any account linked to those email addresses in a matter of seconds. Everyday internet users who rely on the same password across multiple accounts are at the highest risk here. One working credential can get a criminal into an email inbox, and from there they can reset passwords on every other account the victim owns, including banking and financial services.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs (accessed services and application endpoints)

Why This Matters

Stealer logs target regular people going about their daily routines online. The individuals whose data ended up in this file were not necesarily doing anything risky. They may have simply had malware on their computer without knowing it. The consequenses can include credential stuffing attacks across multiple platforms, account takeover, identity theft, and financial fraud. Credentials from leaks like this also get bundled into larger combo lists that circulate online for years, extending the risk window well beyond the original breach date.

How Stealer Log Breaches Work

An information-stealing malware infection often begins without any obvious sign. A user might click on a fake software installer, open an email attachment that looks legitimate, or visit a site that quietly runs malicious code. The malware then runs in the background, harvesting passwords saved in browsers, capturing what the user types, and recording the sites they visit. Everything collected is sent to the attacker as a log file. Those logs are then traded or posted on platforms like Telegram, where other criminals can download and exploit them.

Check If You Are Affected

Your credentials could be in this breach or in thousands of others like it. HEROIC has indexed over 400 billion records from data breaches and stealer logs around the world, and our free scanner makes it easy to check. Enter your email address now to see if you appear in any known breach, and take action to protect your accounts right away.