HEROIC Found the Obsidian Project Dump in Private Telegram Channels

In April 2026, HEROIC analysts monitoring private Telegram channels discovered the Obsidian Project stealer log circulating freely among cybercriminals, a file containing 6,113 records of email addresses, plaintext passwords, and login URLs harvested silently from compromised devices. The dataset had been uploaded on 22 April 2026 by a Telegram user with no public announcement and no notification to any of the people whose data it contained. What makes this discovery especially urgent is how recent it is: the credentials in this file are fresh, meaning many victims have not yet changed the passwords that criminals are already testing against their accounts right now.

Why This Is Dangerous

Fresh stealer log data is among the most dangerous types of credential exposure precisely because of its recency. Victims have not had time to change their passwords, enable two-factor authentication, or even suspect that anything is wrong. Criminals know this and prioritize newly released logs over older datasets. The Obsidian Project file contains plaintext passwords, meaning there is no cracking required, no delay, and no technical barrier between the criminals who downloaded this file and the accounts of the 6,113 people in it. Every hour that passes without action is an hour in which automated tools are testing these credentials across banking apps, email providers, and e-commerce platforms.

What Was Exposed

• Email Addresses: Your email connects every online account you own. Criminals who have it can trigger password resets on any linked service and intercept confirmation emails if they gain access to your inbox, creating a cascade of account takeovers from a single compromised credential.
• Plaintext Passwords: No decryption, no guessing, no delay. These passwords are immediatley usable the moment a criminal downloads the file. If you reused this password on any other service, those accounts are already in the crosshairs of automated credential testing tools.
• URLs: Login URLs captured by the stealer malware reveal exactly which websites and services were accessed on each infected device, giving criminals a prioritized list of high-value targets sorted directly from the victim's own browsing activity.

Why This Matters

The Obsidian Project breach was never disclosed publicly. Because stealer log breaches originate from malware on individual devices rather than from corporate database hacks, there is no single company with an obligation to notify victims. That gap in accountability means the 6,113 people in this dataset are entirely dependent on independent breach researchers like HEROIC to alert them. The breach occured through tools designed to operate with total invisibility, and most victims will only discover their exposure if they actively check a breach database or notice the first signs of account fraud.

How Stealer Log Works

The Obsidian Project dataset was produced by information-stealing malware, a category of malicious software that runs invisibly on an infected device and systematically harvests every saved browser password, active session cookie, and login URL it can find. The malware typically enters a system through a phishing email, a pirated software download, or a malicious browser extension, and begins collecting data immediately without any visible sign to the user. Once harvesting is complete, the stolen credentials are packaged into a log file and uploaded to criminal channels like the private Telegram groups where HEROIC analysts found this file. Each record in the Obsidian Project dataset represents a real person whose own device was silently turned against them.

Check If You Are Affected

HEROIC's free scanner checks your email address against more than 400 billion exposed records, including the newly discovered Obsidian Project stealer log. Go to heroic.com now, enter your email, and receive an instant report showing every breach linked to your credentials. Because this data was just leaked, acting today gives you the best possible chance of changing your passwords before criminals use them against you.