Search Your Email: The Mercadopago Cookies Stealer Log Exposed 99 Accounts

In June 2023, a Telegram user uploaded a stealer log containing 99 records from Mercadopago Cookies, exposing email addresses, plaintext passwords, and URLs belonging to users of Mercado Pago -- Latin America's largest digital payment platform. Mercado Pago accounts are directly linked to bank accounts, credit cards, and peer-to-peer payment transfers, making this breach particulary high risk for financial theft. HEROIC analysts verified and indexed this dataset as part of ongoing dark web monitoring operations. Even a small breach of a financial platform can have outsized consequences for every victim whose credentials were exposed.

Why This Is Dangerous

Mercado Pago is a fintech platform processing billions of dollars in transactions -- credentials for these accounts represent direct access to users' money. Unlike a social media breach, a compromised Mercado Pago login can enable immediate fund transfers, fraudulent purchases, and access to linked bank accounts. Victims of this breach face a serious and ongoing financial threat that requiers immediate action. Cookie-based stealer logs are especially dangerous because they allow criminals to bypass two-factor authentication entirely.

What Was Exposed

• Email Addresses: Account identifiers used to log into Mercado Pago and related financial services -- also the primary target for phishing attacks designed to steal additional credentials.
• Plaintext Passwords: Fully readable passwords stolen directly from infected devices, giving criminals immediate access to Mercado Pago accounts and any other service where the same password was reused.
• URLs: Specific Mercado Pago endpoints and API hosts the victim was authenticated to, confirming active account access and revealing the scope of financial services at risk.

Why This Matters

Smaller, targeted credential sets are often more thoroughly exploited than large general breaches -- criminals have more time to devote to each victiim. When only 99 accounts are exposed, each one may be worked manually by a threat actor who logs in, tests small transfers, then escalates to draining the account or harvesting linked banking details. Mercado Pago's deep integration with real bank accounts means the downstream damage can extend well beyond the platform itself. This breach was verifyied and indexed by HEROIC as part of active dark web monitoring.

How Stealer Log Works

The term "cookies" in the breach name indicates this stealer log specifically captured browser session cookies -- authentication tokens that allow criminals to log into Mercado Pago accounts without needing the password. Unlike a standard credential breach, cookie theft bypasses two-factor authentication entirely because the session is already authenticated. The malware was likely deployed through a phishing attack or malicious browser extension targeting Mercado Pago users. Once a device is infected, the stealer silently harvests cookies, passwords, and URLs in the background and packages them into a log file that is then sold or distributed on Telegram channels.

Check If You Are Affected

HEROIC's free identity scanner searches more than 400 billion exposed records -- including the Mercadopago Cookies stealer log -- to tell you instantly if your credentials were compromised. Visit heroic.com to run your free scan now. For a financial platform breach of this type, changing your password and logging out all active sessions immediately is essential to preventing fraudulent transactions on your account.