MARVEL_PRIME Feb 18-20: 4,593 U.S. Logins Quietly Leaked on Telegram

Date-Coded and Deliberate: The MARVEL_PRIME Collection Strategy

The label "18-20.2" embedded in this file name is a date range: logs collected from February 18 through February 20. MARVEL_PRIME appears to be a structured stealer log operation that tags its releases with collection windows, distinguishing itself from chaotic one-off uploads. On February 25, 2023, a Telegram user published this batch, and inside were 4,593 U.S. credential records. HEROIC's DarkHive analysts confirmed the contents: emails, plaintext passwords, and the exact login URLs where each credential was harvested.

The three-day collection window is significant. It means the infostealer malware was actively running across infected machines during that specific period, funneling credentials back to the operator's server before the batch was packaged and released. Short collection windows like this produce fresh data, accounts that were active and in use during those three days.

Inside the MARVEL_PRIME 18-20.2 File

The data structure is consistent with standard infostealer output:

• Email Addresses: 4,593 U.S. accounts
• Plaintext Passwords: Full cleartext, no hashing
• Target URLs: Service-specific login pages per record

The "3" at the end of the file name suggests this is the third installment in the MARVEL_PRIME series, meaning prior batches covering earlier date ranges were likely released as well. Serial releases like this indicate an organized, ongoing operation rather than an opportunistic single event, which makes the broader MARVEL_PRIME collection more signifcant than any individual file suggests.

What a Three-Day Collection Window Means for Victims

Unlike database dump breaches where millions of records are taken at once, stealer log operations harvest credentials continuously. The 4,593 people in this file were actively using their devices between February 18 and 20, 2023, when the malware was recording their logins. Those accounts were live at the time of capture, making them more likely to still be active when the file hit Telegram five days later.

Attackers who downloaded this file on release day had a narrow window where every account in the file was definitly active and the password definitely unchanged. That window is the most dangerous period. After that, the data continues circulating on forums and in combolists, tested intermitently against services for months or years.

HEROIC Tracks MARVEL_PRIME and Similar Dated Operations

HEROIC's DarkHive team indexes stealer log batches from Telegram operations like MARVEL_PRIME into a breach database now covering more than 400 billion records. The free scanner at HEROIC.com checks any email against this full dataset in seconds. If you appeared in this batch or any related MARVEL_PRIME release, you'll find out immediately.