Mixed Provider Users Hit: MixNugget Log Exposes 2,693 Passwords

HEROIC analysts detected a stealer log titled "MixNugget" that was uploaded to a Telegram channel on April 27, 2026. The dump contains 2,693 records from a mix of email providers, with each entry including the victim's email address, plaintext password, and the URLs they were browsing when the credential-stealing malware captured their data. The "Mix" prefix indicates this file contains credentials from multiple email ecosystems rather than targeting a single provider.

Mixed-provider dumps cast a wide net across the internet, affecting users of Gmail, Hotmail, Yahoo, Outlook, and other services simultaneously. This diversity makes the dump useful to a broader range of attackers and increases the total number of potential victims.

Why Plaintext Passwords Across Multiple Providers Compound the Risk

All 2,693 passwords are stored in plaintext, fully readable and immediately exploitable. When a dump spans multiple email providers, the attack surface expands dramatically. An attacker does not need to specialize in one ecosystem. They can simultaneously target Google accounts, Microsoft services, Yahoo Mail, and countless other platforms using the same credential file.

Each plaintext password provides an instant key to the associated account. No computational power is needed for hash cracking, and no rainbow tables are required. The credentials are ready to use out of the box, making this a plug-and-play toolkit for account takeover campaigns across the entire spectrum of email and web services.

What Was Exposed in the MixNugget Dump

• Email Addresses — Accounts from multiple providers including Gmail, Hotmail, Yahoo, and others, creating a diverse set of attack vectors across different platform ecosystems.
• Plaintext Passwords — Unencrypted passwords extracted from browser credential stores, usable against any service where the victim has saved their login.
• URLs — Websites the victims were actively using during the malware infection, revealing which specific services are immediately vulnerable to credential replay.

Why 2,693 Mixed Credentials Unlock a Vast Attack Surface

When credentials come from multiple email providers, the downstream impact of credential stuffing intensifies. Gmail credentials can unlock Google Drive, YouTube, and Google Pay. Hotmail credentials open the door to OneDrive, Outlook, and Xbox. Yahoo logins may expose fantasy sports accounts, financial data, and news subscriptions. Each provider ecosystem amplifies the damage.

The diversity of the MixNugget dump also means attackers can cross-reference credentials. If a victim's Gmail password matches their Amazon or PayPal password, the compromise extends well beyond email. With 2,693 multi-provider credentials, the total number of accessible accounts across all platforms could easily reach 8,000 to 10,000 through credential-stuffing campaigns.

How Stealer Logs Aggregate Mixed-Provider Credentials

Infostealer malware does not discriminate by email provider. When it infects a device, it captures every saved password from every installed browser. A single infected computer might yield credentials for Gmail, Hotmail, a work email, and accounts on dozens of additional platforms. The malware packages all this data into a single log file.

Distributors sometimes leave these mixed logs intact rather than sorting by provider, resulting in dumps like MixNugget that span the full range of email services. These unsorted or lightly sorted files are common on Telegram because they appeal to a general audience of attackers. Some buyers prefer mixed dumps specifically because the variety increases the chances of finding high-value targets across different platforms and industries.

Check If Your Credentials Appear in This Leak

Because the MixNugget dump spans multiple email providers, users of any email service could be affected. HEROIC provides a free breach scanner that checks your email address against over 400 billion compromised records from stealer logs, data breaches, and dark web sources.

Search your email now to find out if your credentials were captured in the MixNugget dump or any other known breach. If your information is found, change your password on the affected account and on every other service where you have used the same password. Enable two-factor authentication to ensure that a leaked password alone is not enough to access your accounts.