One IT 6.28 Password Could Unlock a Chain of Accounts

HEROIC found a stealer log file labeled IT 6.28 circulating on Telegram in February 2023. Focused on Italian users, this dataset contains 34,356 records captured by infostealer malware, each entry pairing an email address with a plaintext password and the URL of the service being accessed at the time of theft.

Plaintext Passwords Require No Cracking

The passwords in IT 6.28 are stored in their original, readable form. No hashing algorithm was applied, and no decryption is needed. Every credential in this file is a working key that attackers can use the moment they access the dataset. The speed from leak to exploitation is nearly instantaneous, giving victims virtually no window to react before their accounts are tested.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs (Italian web services and international platforms)

The Chain Reaction of Password Reuse

When one password opens multiple doors, a single stealer log entry becomes exponentially more dangerous. Attackers understand that people frequently use identical passwords across their email, banking, shopping, and streaming accounts. With 34,356 credential pairs from IT 6.28, automated credential stuffing tools can test each combination against hundreds of popular services in minutes. For victims who reused their passwords, one stolen credential triggers a chain reaction that compromises account after account.

Where Stealer Logs Come From

Stealer logs like IT 6.28 are the product of infostealer malware that infiltrates personal devices. These programs are commonly spread through cracked software, fake game mods, and phishing campaigns. Once executed, the malware extracts every saved credential from the victim's browsers, including usernames, passwords, session cookies, and autofill data. The stolen information is packaged into organized log files and sold or shared freely through Telegram groups and dark web forums, where other attackers use them for targeted exploitation.

Check If Your Credentials Were Exposed

If you use Italian web services or have ever saved login credentials in your browser, your data could be part of the IT 6.28 leak. HEROIC's breach scanner covers over 400 billion compromised records. Run a search with your email address to find out whether your credentials have been exposed in this or any other breach, and take immediate steps to change affected passwords and enable multi-factor authentication.