Mansory 14 Leak Means 69,789 Accounts Are Ready to Steal

HEROIC's monitoring systems flagged a stealer log file labeled "Mansory 14" that was uploaded to Telegram in December 2025. The file contains 69,789 credential records, each consisting of an email address, a plaintext password, and the URL of the website where the credential was captured. This data was extracted silently from infected devices by infostealer malware and is now freely accessible to anyone on Telegram.

Plaintext Passwords: The Fastest Path to Account Takeover

Unlike breaches where passwords undergo hashing before storage, the Mansory 14 dump contains passwords in their raw, readable form. This means attackers face no computational challenge—no hash cracking, no dictionary attacks. They simply read the password and use it. For the 69,789 individuals in this file, the threat is not theoretical—it is immediate and actionable.

What Was Exposed

• Email Addresses – Unique identifiers tied to online accounts, enabling both login attempts and phishing
• Plaintext Passwords – Passwords stored in clear text, instantly usable for unauthorized access
• URLs – The specific web services where each set of stolen credentials was originally entered

Credential Stuffing Puts Every Linked Account at Risk

Threat actors treat dumps like Mansory 14 as ammunition for automated credential stuffing campaigns. Bots cycle through each email-password pair, testing them against banking portals, email services, social media platforms, and corporate systems. A single match can escalate from a compromised email to a drained bank account in hours. With nearly 70,000 credential pairs, the potential for large-scale damage is substantial.

Mansory Stealer Logs: A Recurring Threat

The "Mansory" label identifies a series of stealer log releases that have been appearing on Telegram. The underlying data comes from infostealer malware—trojans like Lumma, RedLine, and Raccoon that spread through phishing emails, fake software updates, and malicious advertisements. Once installed on a victim's device, the malware quietly extracts saved browser credentials, session cookies, and form autofill data, then packages it into log files for distribution to criminal networks.

Check If Your Credentials Were Exposed

With 69,789 records in this Mansory 14 release, your credentials may be circulating among threat actors right now. HEROIC's breach scanner draws on a database of over 400 billion compromised records to provide definitive answers. Search your email to find out if your credentials were part of this dump or any other breach indexed by HEROIC.