Dark Web Intel: 2.84M Records Leaked in Mansory 1 Stealer Log

Dark Web Intel: 2,842,977 Records Found in the "Mansory 1" Stealer Log

While monitoring Telegram channels used for trading stolen credentials, HEROIC's threat intelligence team identified "Mansory 1," a stealer log uploaded on 13 March 2026 containing 2,842,977 records. It is the largest file in this series HEROIC has tracked, pairing each email address with a plaintext password and the login URL it was captured from, spanning a broad mix of websites.

Why This Intel Signals a Serious Threat

A log of nearly 2.9 million plaintext credentials represents a significant supply of ready-to-use logins for the criminal underground. Dark web intelligence like this helps identify which malware campaigns are actively harvesting data at scale, and this dump suggests one was running for some time before the data was compiled and released.

What Was Exposed

• Email addresses
• Plaintext passwords
• Login URLs across a wide range of sites

Why Intelligence on a Dump This Size Matters to You

With nearly 2.9 million credential pairs circulating, the odds of automated credential stuffing, account takeover, identity theft, and financial fraud rise sharply, not just for a handful of victims but potentially for millions of separate accounts across banking, retail, and social platforms.

How Dark Web Monitoring Uncovers Logs Like This

Infostealer malware infects devices through pirated software, cracked downloads, and malicious attachments, silently harvesting saved passwords and cookies from each victim. Sellers operating under aliases like "Mansory" compile these harvests into massive numbered dumps and circulate them on Telegram and dark web marketplaces, where HEROIC's analysts track them.

Check If You Are Affected

With millions of records in circulation, checking your exposure is essential. HEROIC's free breach scanner searches more than 400 billion breached and leaked records, including dark web stealer logs like this one, so you can confirm your status right now.