Inside the New Burn Update Logs: How Stealer Malware Stole 19,014 Passwords

HEROIC analysts identified a stealer log breach on October 30, 2025, when a Telegram user uploaded a file labeled New Burn Update containing 19,014 records harvested from compromised endpoints. The leaked data included email addresses, plaintext passwords, and URLs representing services accessed from infected machines. With nearly 20,000 exposed credential sets, this breach represents a meaningful risk for anyone whose device may have been targeted by the malware behind this log.

Why This Is Dangerous

Plaintext passwords are ready to use the moment they are stolen. Unlike hashed passwords that require cracking, these credentials can be tested against email inboxes, social media accounts, banking portals, and workplace systems within minutes of the log being published. The URL data included in this leak also tells attackers exactly which services each victim was using, allowing for highly targeted follow-up attacks rather than random guessing.

What Was Exposed

The New Burn Update stealer log contained the folowing data types for each of the 19,014 compromised records:

• Email Addresses
• Plaintext Passwords
• URLs (including API host endpoints)

Why This Matters

Credential stuffing is the most direct threat from a breach like this. Attackers load stolen email and password pairs into automated tools that test them across hundreds of websites simultaneously. A single reused password can lead to account takeover on multiple platforms at once. From there, the risks multiply: identity theft, unauthorised purchases, fraudulent loan applications, and even takeover of work accounts that grant access to company systems and customer data, leading to potentail finantial damage for both individuals and businesses.

How Stealer Log Breaches Work

Stealer malware typically enters a device through a malicious download disguised as legitmate software, a cracked game, or a browser extension. Once running, it silently records login credentials as the user types them into websites and applications. It also captures the URLs of every site visited, creating a detailed profile of the victim's online activity. The malware then transmits this harvested data as a log file to the attacker, who either sells it on underground markets or publishes it on Telegram channels for free distribution. The New Burn Update file is a direct example of this process.

Check If You Are Affected

The New Burn Update breach is part of the HEROIC breach database, which now contains over 400 billion leaked records from thousands of incidents worldwide. Use the free HEROIC Identity Monitor to search your email address and find out immediately whether your credentials appear in this or any other known breach.