The LOGS_CENTER Dump: 24,724 Stolen Login Records Hit Telegram

HEROIC analysts first identified this leak in late October 2023 while monitoring Telegram channels known for hosting stealer log files. The data dump, uploaded by an anonymous Telegram user and labeled 10.24 - LOGS_CENTER, contained 24,724 records exposing a combination of email addresses, plaintext passwords, and specific API endpoint URLs. What made this particular log stand out was its apparent focus on a narrow set of infrastructure targets rather than the broad, indiscriminate credential dumps we more comonly see circulating on these channels.

Why This Is Dangerous

Most credential leaks involve usernames and passwords, but this one went further. The inclusion of specific API host addresses and endpoint URLs means attackers do not have to guess where to use the stolen credentials. They already have a roadmap. When those credentials are also stored in plaintext, the barrier to carrying out an account takeover drops to nearly zero. Any attacker with access to this file could begin attempting logins imediately without any additional work to crack hashed passwords.

What Was Exposed

• 24,724 total records
• Email addresses linked to active accounts
• Plaintext passwords (no hashing or encryption)
• Specific URLs and API host information
• Endpoint data pointing to targeted infrastructure
• Leak first appeared on Telegram on October 23, 2023

Why This Matters

Stealer logs like this one are not random. The data is harvested by malware installed on victims' machines, often through phishing emails or compromised software downloads. Once installed, the malware silently collects anything stored in browsers, password managers, or local files. The resulting log files are then sold or shared freely on Telegram. The 10.24 - LOGS_CENTER file represents just one snapshot of this ongoing pipeline. Organisations whose infrastructure endpoints appear in this log face a direct and immediate risk of unauthorized access.

How Stealer Logs Work

Stealer malware is a category of software designed to extract saved credentials from an infected device. It typically targets browser-stored passwords, autofill data, and session cookies. Once the malware runs, it packages everything it finds into a compressed log file and sends it back to the attacker's server or directly to a Telegram bot. These logs are then sorted, deduped, and either sold on underground forums or dumped publically on Telegram channels. The whole process from infection to available-for-download log can happen in under an hour. The 10.24 - LOGS_CENTER log appears to have followed this exact pattern.

Check If You Are Affected

If your email address was among the 24,724 records in this stealer log, your password and the URLs you were logged into may already be in the hands of someone looking to use them. HEROIC's free breach scanner checks your email against more than 400 billion leaked records, including stealer log data like this. It takes less than a minute and shows you exactly what informaton about you has surfaced on the dark web. Check your exposure now before someone else acts on it first.