Moon Light Private 4 Leak Hits 97,151 Online Service Logins

"MOON LIGHT PRIVATE 4" is the fourth entry in a series of stealer logs that surfaced on Telegram on 05-Oct-2025, this one holding 97,151 records pulled from accounts spanning all kinds of online services, from webmail to shopping to streaming.

Why This Is Dangerous

Because the data touches so many different types of online services at once, attackers definately get a one stop shop for credential stuffing across entire industries. A single victim's stolen login might unlock their email, their retail account, and a dozen other services all at the same time.

What Was Exposed

• 97,151 records
• Email Addresses
• Plaintext Password
• URLs identifying each service

Why This Matters

Online services of every kind, banking, retail, entertainment, and email, rely on people using strong unique passwords to stay safe, but stealer logs like this expose exactly how often that advice gets ignored. Wich services were hit isn't the point so much as how many different ones were probably affected inside this single file.

How Stealer Logs Work

Malware infections don't care what industry a website belongs to, they simply grab whatever is saved in the browser and recieve it automatically on the operator's end at the time of infection. That's why a single stealer log can span dozens of unrelated services, all bundled together based on nothing more than which device happened to get infected.

Check If You Are Affected

Whatever services you use most, it's worth taking thirty seconds to check. HEROIC's free breach scanner covers over 400 billion leaked records across every industry imaginable, so you can confirm whether your accounts were caught up in this one.