The Moon_Bases 122 Data Quietly Appeared on the Dark Web Last Week

HEROIC analysts detected a stealer log dataset uploaded to Telegram in July 2025 containing 728,041 records. The file, identified as Moon_Bases 122, surfaced quietly on dark web monitoring channels where it was distributed without major announcement. It contained email addresses, plaintext passwords, and the specific URLs where each credential was captured by infostealer malware running on victims' machines. At nearly three quarters of a million records, this is among the larger stealer log collections circulating from that period.

Why This Is Dangerous for the 728,041 People in the Moon_Bases 122 Log

A dataset of this scale gives attackers a massive inventory of ready-to-use credentials. Each record includes your email, your password in fully readable plaintext, and the exact website it was harvested from. There is no guessing, no cracking, and no delay. Criminals use this data to take over bank accounts and email inboxes, reset passwords across every other service tied to a compromised email, access employer systems when corporate credentials are included, and flip large batches of verified logins on dark web markets for quick profit.

Data Found in the Moon_Bases 122 Stealer Log

• Email Addresses
• Plaintext Passwords
• URLs (the specific sites where each credential was captured)

Credential Stuffing at Scale: How 728,041 Records Fuel Account Takeover and Identity Fraud

A file of 728,041 credential pairs is not just a threat to the individuals in it. It is raw fuel for industrial-scale automated attacks. Criminals run these records through credential stuffing tools that simultaneusly test them against banking platforms, retail sites, streaming services, and corporate VPNs. Because password reuse is the norm rather than the exception, attackers typically find thousands of working logins within hours of getting their hands on a dump this size. Victims then face account takeovers, identity theft through accessed personal documents, and financial fraud through saved payment methods that attackers can exploit before the victim even knows the breach happened.

What Is the Moon_Bases Stealer Log Series and How Are These Files Assembled?

The Moon_Bases naming convention suggests a recurring operation by a threat actor or reseller who bundles infostealer output into numbered archives for distribution. Infostealer malware like Lumma, RedLine, and Meta Stealer infects computers through malvertising, cracked software downloads, and phishing campaigns. Each infected machine produces a log file containing browser-saved credentials, session cookies, and keystrokes. These individual logs are then aggregated into bulk collections, numbered sequentially, and uploaded to Telegram channels where subscribers can downlod them freely or purchase access. The Moon_Bases 122 upload represents one installment in what appears to be an ongoing series of credential distribution operations.

Your Data May Have Appeared Quietly: Check Now With HEROIC's Free Breach Scanner

HEROIC's free breach scanner checks your email against more than 400 billion exposed records, including large stealer log collections like Moon_Bases 122 that circulate without major news coverage. Most people only find out their credentials were leaked months after the fact. Check right now at heroic.com and find out in under 30 seconds whether your data is already in criminal hands.