The Mansory 4 Stealer Log Exposed 1 Million US Accounts

HEROIC analysts discovered the Mansory 4 stealer log on November 7, 2025, containing 1,018,463 email and password pairs targetd at users in the United States. This is the fourth batch in the Mansory series, distributed through Telegram as a URL-login-password formatted credential dump.

Why the Mansory 4 Stealer Log Is Dangerous

The Mansory series focuses generaly on North American users, with this batch drawing credentials from Windows computers across the United States. This geographic concentration means the accounts in the log skew heavily toward US-based platforms and services, including American retail sites, banking portals, and email providers popular with domestic users.

What Was Exposed in the Mansory 4 Leak

• Email Addresses
• Plaintext Passwords
• URLs matching each credential to a specific US-facing website

Why This Mansory 4 Data Puts You at Risk

With over 1 million records all linked to US-based accounts, the Mansory 4 log is a highly targeted asset for attackers focused on American financial institutions, online retailers, and popular consumer platforms. The URL field in each record tells the attacker exactly which website to hit, making credential stuffing campaigns far more efficient than generic lists with no geographic filter.

How Stealer Logs Work

Stealer malware infects computers through phishing emails, fake software downloads, and social engineering. Once on a device, it reads all saved browser passwords and sends them to the attacker's servers. The collected data is then sorted by geography and account type into numbered series like Mansory, making it easier for buyers to target specific regions or types of accounts.

Check If Your Data Was Exposed

HEROIC operates one of the world's largest breach databases, covering more than 400 billion leaked records. Use HEROIC's free breach scanner to check if your email address or credentials appeared in the Mansory 4 leak or thousands of other breaches in our database.