Our Analysts Found the Obsidian Project Dump Circulating in Private Telegram Channels

HEROIC threat intelligence analysts identified the Obsidian Project stealer log dataset circulating within private Telegram channels in April 2026. The dataset contains 12,226 records collected by infostealer malware, with each record including an email address, a plaintext password, and the URL of the service from which the credentials were stolen. The Obsidian Project name, combined with the structured log format, suggests an organized and ongoing credential harvesting operation rather than a single isolated attack. Our analysts have indexed this dataset in the HEROIC breach intelligence platform to enable affected users to check their exposure immediately.

Why This Is Dangerous

The Obsidian Project dump was found circulating in private, invite-only Telegram channels frequented by organized cybercriminal groups. Private channel distribution is significently more dangerous than public posting because it means the data is being selectively shared among actors who are likely to use it immediately and efficiently. By the time HEROIC analysts discover a dataset in private channels, it has typically already been in active use for days or weeks. The 12,226 records in this dump, each paired with a plaintext password and target URL, give attackers a ready-made attack kit requiring no additional processing before being weaponized against victims' accounts.

What Was Exposed

• Email Addresses - Email accounts harvested from infected devices, forming the primary identifier for targeted phishing and account takeover attacks
• Plaintext Passwords - Unencrypted passwords captured in real time from browser sessions and saved credential stores, ready for immediate exploitation
• URLs - The specific login endpoints and services where each credential pair was stolen, providing attackers with a precise account-by-account attack roadmap

Why This Matters

When HEROIC analysts find a stealer log circulating in private Telegram channels, it signals that the data has been vetted and found valuable by cybercriminal communities. These private channels function as marketplaces where only trusted actors share high-quality breach data, meaning the Obsidian Project dump was screened for freshness and usability before distribution. For victims, this means their credentials were likely tested and potentially used before any public awareness of the breach existed. The 12,226 records represent real individuals whose login sessions were invisibly captured, and many may not realize their accounts have already been acessed without authorization.

How Stealer Log Breaches Work

The Obsidian Project dataset was generated by infostealer malware that silently compromised victims' devices and extracted credentials without triggering antivirus detection. Infostealers typically spread through malicious advertising networks, phishing campaigns targeting specific user demographics, or bundled within pirated software and game cheats. Once installed, the malware operates in the background, capturing every login session in real time and transmitting the compiled credential log to the attacker's infrastructure. The Obsidian Project label applied to this dataset indicates the attacker organized their harvest into named campaign batches, a common practice among professional infostealer operators managing multiple concurrent malware deployments. HEROIC analysts actively monitor these channels and named campaign series to index new datasets as rapidly as possible.

Check If You Are Affected

HEROIC maintains the world's largest breach intelligence database, with over 400 billion compromised records including the Obsidian Project dataset and thousands of related stealer log collections from the same Telegram distribution ecosystem. Use the HEROIC free scanner at HeroicSecurity.com to instantly search your email address and discover every breach that contains your personal data. If you appear in the Obsidian Project dump, immedietly change all passwords associated with the exposed email address, activate multi-factor authentication on all important accounts, and watch for suspicious login activity. HEROIC's monitoring tools can also alert you in real time if your email appears in future stealer log releases from the same threat actors.