Morocco Telegram Log Exposed Exactly 5,080 Email Logins

In January 2023, HEROIC analysts identified a stealer log file titled "Morocco," uploaded to a Telegram channel by an unidentified user. The file contained exactly 5,080 records, each consisting of an email address, a plaintext password, and the URL of the login page the credentials were used on.

Why This Stealer Log Is Dangerous

Regardless of how a file like this is labeled, the risk it poses comes down to the same thing: real, working login credentials sitting in the hands of whoever downloaded it. Because the passwords here are stored in plaintext, there is nothing standing between having the file and using the credentials against real accounts.

What Was Exposed in the Morocco Log

• Email addresses
• Plaintext passwords tied to each account
• URLs showing the login pages the credentials were used on

Why This Matters

Every entry in this file represents a working email and password pair that can be tested against other websites through credential stuffing. If any of the 5,080 passwords were reused elsewhere, those accounts are exposed to takeover, which can lead to fraud or further data theft depending on what the account is used for.

How Stealer Logs Work

This type of leak is produced by info-stealing malware running on individually infected computers rather than a breach of a single company's systems. The malware is typically spread through cracked software, malicious downloads, or fake installers, and once active it quietly copies saved browser credentials before sending them back to the attacker. The resulting file is then shared or sold through Telegram channels, which is where HEROIC's analysts located this one.

Check If You Are Affected

If you want to know whether your email address appears in a leak like this, HEROIC's free breach scanner searches more than 400 billion leaked records to give you a fast, clear answer at no cost.