Attackers Can Now Access 9,380 U.S. Accounts Using the Obsidian Project Stealer Log

HEROIC's DarkHive team flagged the Obsidian Project stealer log in April 2026 after it surfaced on a public Telegram channel. The file contained 9,380 records tied to users in the United States, each one pairing an email address, a plaintext password, and the URL of the targeted service. It was posted on April 1, 2026 and spread freely across Telegram's distribution network with no access barrier and no cost to anyone who downloaded it.

At 9,380 records, this is not a minor exposure. That is 9,380 people whose email addresses and working passwords are now in the hands of anyone who thought to download the file.

Identity Theft Starts With Files Like This One

Stealer logs are the raw material of identity theft at scale. Once an attacker has your email address and your password, they have the starting point for a chain of compromises. Email access unlocks password resets on other services. Password resets unlock financial accounts. Financial accounts expose transaction history, linked payment methods, and personal identifiers. The cascade from one stolen credential to a full identity compromise is faster and more systematic than most people realize.

The Obsidian Project log accelerates that process because the passwords require zero additional work. They are stored in plaintext, immediately readable and usable. No cracking required, no waiting, no technical barrier between the file and the attack.

What the Obsidian Project File Contains

• Email addresses linked to personal and professional services
• Plaintext passwords stored with no encryption or protection
• URLs and API endpoints identifying which platforms and services were compromised

Why Telegram Distribution Is Worse Than the Dark Web

Dark web marketplaces have friction built in. Buyers need to register, build reputation, often pay in cryptocurrency, and navigate onion routing. None of that applies to a public Telegram channel. This file was available to anyone with a Telegram account the moment it was posted. Distribution channels on Telegram can have tens of thousands of subscribers, and redistribution to other channels is instant.

Once a stealer log goes up on Telegram, it cannot be recalled. The data is out. The only question is how many people downloaded it and what they have done with it since.

How Infostealer Malware Harvests Credentials Like These

The Obsidian Project log was assembled from devices infected with infostealer malware. These programs are built to be invisible. They arrive via phishing emails, fake installers, or malicious browser extensions and begin collecting data immediately: saved browser passwords, active session tokens, stored application credentials, and crypto wallet files.

Everything collected is packaged into a structured log file and transmitted to the operator's Telegram channel. The victim's device looks and behaves normally throughout. Most people in a stealer log have no memory of anything unusual happening on the day their device was compromised. The malware runs once, exits, and leaves no obvious trace.

Protect Your Identity Before Someone Else Uses Your Data

If your email address appears in the Obsidian Project stealer log, your password for at least one service is already in the open. Any account where you used that same password is now vulnerable. HEROIC's free breach scanner checks your email against more than 400 billion exposed records, including this dataset, and returns results in seconds.

Knowing you are in a breach is the first step to containing the damage. Staying unaware is how one compromised password becomes ten compromised accounts.

Scan your email at HEROIC.com. It is free and takes under a minute.