mansory 13: 594,943 Passwords Exposed. Yours Might Be Among Them.

HEROIC analysts identified a stealer log dataset shared on Telegram in December 2025 containing 594,943 records. The file, part of a series labeled mansory 13, exposes email addresses, plaintext passwords, and URLs gathered by information-stealing malware from hundreds of thousands of compromised devices. The mansory series represents an ongoing credential distribution operation, with this file being one of the larger releases in the campaign.

Nearly 600,000 Exposed Passwords: The Scale of the mansory 13 Leak

A dataset containing almost 600,000 plaintext passwords paired with email addresses and login URLs is a significant resource for credential stuffing operations. At this scale, attackers can run systematic campaigns against banking portals, email providers, streaming platforms, and social media services, expecting thousands of successful logins even from a modest percentage match rate. Each successful credential stuffing attempt can lead to account takeover, financial fraud, or identity theft.

What the mansory 13 Leak Exposed

• Email Addresses
• Plaintext Passwords
• URLs (login endpoints from which credentials were harvested)

594,943 Passwords Exposed: Who Is Most at Risk From This Breach

Anyone whose device was infected with the malware behind this campaign faces potential credential compromise. Victims who reuse passwords across multiple services are at the highest risk, as the same login credentials captured here could unlock email accounts, banking portals, and social media profiles. The plaintext format of the passwords in this dataset means attackers can put them to use immediately without any additional processing.

How Stealer Log Breaches Work

Stealer logs are created by malicious software installed on victims' devices through phishing emails, malicious downloads, or compromised websites. Once running, the malware silently captures every username, password, and URL the victim accesses through their browser. These credentials are packaged into structured files and distributed through Telegram channels in numbered series like mansory, which release new batches regularly as more devices are compromised.

Check If Your Data Was Exposed

HEROIC's free breach scanner indexes more than 400 billion exposed records, including the mansory stealer log series. Enter your email to find out whether your credentials appear in mansory 13 or any related dataset. If they do, changing your passwords immediately, especially on email and financial accounts, is the most important first step you can take.