One Telegram Post Exposed 6,424 TOR_LOG MIX Stealer Records

Alongside the 299PCS file, HEROIC's analysts also found TOR_LOG MIX 301PCS uploaded to the same Telegram channel in July 2024. This release contains 6,424 records, each pairing an email address with a plaintext password and the URL where that login was captured.

Why the TOR_LOG MIX 301PCS Leak Is Dangerous

This file was assembled the same way as its companion release, pulling live credentials directly from infected devices. Because each record already includes the destination website, anyone who obtains the file can attempt to log in immediately, with no additional research needed to figure out where a password belongs.

What the TOR_LOG MIX 301PCS File Contains

• Email addresses
• Plaintext passwords
• URLs of the websites each credential unlocks

Why This Leak Matters to You

With over six thousand records in a single upload, TOR_LOG MIX 301PCS gives attackers a substantial pool of working credentials to test through automated tools. Every match found through credential stuffing can lead to a compromised email account, unauthorized financial transactions, or a stolen identity used to open new accounts elsewhere.

How the TOR_LOG MIX 301PCS Stealer Log Was Created

Just like the related 299PCS release, this file's "301PCS" label points to 301 separate infected device logs bundled together. Stealer malware operators commonly release these numbered batches in quick succession, using the same naming pattern to build a catalog of files for buyers browsing Telegram channels.

Check If You Are in the TOR_LOG MIX 301PCS Leak

Use HEROIC's free breach scanner to check your email against TOR_LOG MIX 301PCS and the rest of our database of more than 400 billion leaked records. If your credentials appear, change that password right away and enable two-factor authentication wherever it's offered.