How PCASTRA’s Malware Led to 35,795 Stolen Passwords Being Sold Online

In December 2025, HEROIC analysts identified a stealer log advertised as "40K Private Number Pass HQ PCASTRA" circulating on a Telegram channel under the handle PCASTRA. HEROIC's analysis confirmed 35,795 verified records in the file, including email addresses, plaintext passwords, and the URLs each login was tied to. The "HQ" and "Private" labels signal that this was marketed as a premium, exclusive list rather than a freely shared dump.

Why This Is Dangerous

This leak began the same way most large credential dumps do: information-stealing malware infected a batch of devices, quietly collecting saved logins before anyone noticed. The operator behind the PCASTRA account then compiled, filtered, and verified those stolen logins into a single high-quality file before offering it privately on Telegram. Because each of the 35,795 records pairs a working email address with its plaintext password and the site it unlocks, anyone who buys this list can start logging into accounts immediately, with no additional effort required.

What Was Exposed

This leak included the following data types:

• Email addresses
• Plaintext passwords, verified as working
• URLs linked to each set of credentials

Why This Matters

A verified list of this size, sold privately rather than given away, tends to end up in the hands of attackers running serious credential stuffing operations rather than casual opportunists. Because people frequently reuse passwords across email, banking, and shopping accounts, the 35,795 credentials in this file could lead to account takeover well beyond whatever service the data was originally tied to. The private marketing also suggests this list was sold to a smaller number of buyers, each with the resources to use it at scale.

How Stealer Logs Work

A stealer log begins with information-stealing malware, malicious software that infects a device through cracked programs, fake downloads, or phishing attachments. Once running, it silently pulls saved browser passwords, autofill data, and active sessions, then sends everything back to whoever controls the malware. From there, operators like the one behind PCASTRA collect, verify, and package the stolen data into "HQ" or "private" lists, adding a premium price tag because the credentials have already been tested and confirmed to work, exactly what happened to the 35,795 records in this file.

Check If You Are Affected

With 35,795 verified records in this single file, checking your exposure now could prevent real damage later. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including verified stealer logs like this one, so you can find out quickly and change any reused passwords before someone else gets there first.