How the Mansory 5 Stealer Log Exposed 2.5M Passwords Online

HEROIC analysts traced how a stealer log labeled "Mansory 5" made its way onto a Telegram channel on March 11, 2026. The sequence is a familiar one: infostealer malware silently infected a batch of victims' computers, harvested whatever login data it could find, and packaged the results into a single file containing 2,549,460 records. That file, holding email addresses, plaintext passwords, and the URLs of the accounts they belong to, was then uploaded and made freely available to anyone in the channel.

Why This Is Dangerous

Because the malware pulled these credentials directly from victims' browsers, every password in the file is stored in plaintext, meaning an attacker does not need to crack, decrypt, or guess anything. Each entry pairs an email, a password, and the exact site it unlocks, so a criminal working through this log can go straight to logging in. With 2.5 million records involved, this is the kind of file that automated attack tools can work through at scale, testing thousands of logins in minutes.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the websites where the credentials were used

Why This Matters

The path from this leak to real harm runs through password reuse. Anyone in the 2,549,460 affected records who used the same email and password on more than one site is exposed to credential stuffing, where attackers automatically test stolen logins across banking, email, and shopping platforms. From there, a single reused password can open the door to account takeover, financial fraud, or identity theft, especially since the URLs make it clear exactly which services each credential belongs to.

How Stealer Logs Work

Stealer logs are produced by infostealer malware, software designed to infect a device quietly, often bundled inside pirated software, cracked games, or fake downloads, and then scan the browser and system for saved passwords, autofill entries, and session data. Once collected, the results are compiled into a log file and distributed, frequently through Telegram channels that specialize in trading this kind of data. Because a single infection can capture dozens of saved logins from one victim, a log like Mansory 5 can reach millions of records from a relatively small number of infected machines.

Check If You Are Affected

To find out if your email or passwords are part of this stealer log, HEROIC's free breach scanner searches a database of more than 400 billion leaked records, including stealer log dumps like this one. It only takes a moment to check, and it could be the difference between catching an exposed password early and having it used against you.