MARVEL_PRIME 10.12 uploaded by a Telegram User

We've been tracking a steady rise in stealer log breaches appearing on Telegram channels, but a recent leak stood out due to the specific combination of data exposed. It wasn't just the volume of credentials; it was the inclusion of API endpoints alongside usernames, emails, and passwords that suggested a potentially high-value target. The data had been circulating quietly since early 2023, but we noticed a spike in chatter referencing it this week, prompting a deeper dive.

MARVEL_PRIME: Stealer Log Exposes 26k+ Credentials and API Endpoints

A stealer log file, dubbed MARVEL_PRIME 10.12, surfaced on Telegram in January 2023, exposing 26,921 records. The leak includes a mix of sensitive information, including email addresses, plaintext passwords, and URLs. What caught our attention was the presence of API host addresses alongside user credentials, suggesting the potential for automated account takeover or lateral movement within compromised systems. This combination of data points presents a significant risk to affected organizations.

The breach was discovered by our team while monitoring known Telegram channels frequented by threat actors. The file, uploaded by a Telegram user, initially flew under the radar. However, recent discussions and renewed interest in the file prompted a closer examination. The fact that passwords were stored in plaintext significantly amplifies the impact of this breach, making account takeover trivial for anyone with access to the data.

Breach Stats:

• Total records exposed: 26,921
• Types of data included: Email Addresses, Plaintext Passwords, URLs, API Host Addresses
• Sensitive content types: Credentials, API endpoints
• Source structure: Stealer Log
• Leak location(s): Telegram channel
• Date of first appearance: 03-Jan-2023

The risk associated with stealer logs is well-documented. Security researchers at SpyCloud have consistently highlighted the threat posed by malware that harvests credentials and other sensitive data from compromised systems. These logs are often traded and sold within underground communities, providing attackers with a readily available source of compromised credentials. The inclusion of API endpoints in this particular log elevates the risk beyond simple account compromise. As noted by threat intelligence firm KELA, stealer logs are often a precursor to more sophisticated attacks, including ransomware deployment and data exfiltration.