Plaintext Passwords for 906 URLs in HQ Brazil Condorthecracker Leak

HEROIC threat analysts identified a stealer log titled "HQ Brazil Condorthecracker" that was uploaded to a Telegram channel on June 28, 2026. The file contained 906 compromised records, each pairing an email address with a plaintext password and the URL where the credentials were used. The data was freely available for download by anyone in the channel.

Why Plaintext Passwords Are Immediately Dangerous

Every password in this stealer log is stored in plaintext, meaning there is no encryption or hashing protecting it. An attacker who downloads this file can log into the associated accounts within seconds. There is no cracking step, no decryption delay. If any of these 906 passwords are reused across banking, email, or social media accounts, those accounts are immediately at risk of takeover.

What Was Exposed in This Stealer Log

• Email addresses tied to individual user accounts
• Plaintext passwords with no encryption or hashing
• URLs identifying the exact websites and services where credentials were used

Why 906 Stolen Credentials Still Matter

Even a relatively small set of credentials can cause significant damage. Attackers use stolen email and password pairs to launch credential stuffing attacks, testing the same combinations across hundreds of popular websites. Because most people reuse passwords, a single plaintext password from this leak could unlock email inboxes, online banking portals, shopping accounts, and cloud storage. That opens the door to identity theft, financial fraud, and unauthorized data access.

How Stealer Logs Work

Stealer logs are created by malware that silently runs on a victim's device. Once installed, the malware captures saved passwords from web browsers, email clients, and other applications. It also records the URLs those credentials belong to, creating a detailed map of a victim's online accounts. The collected data is then packaged into log files and shared or sold through channels like Telegram, dark web forums, and private marketplaces. Unlike database breaches that target a single company, stealer logs harvest credentials from many different services at once, making them especially valuable to cybercriminals.

Check If Your Credentials Were Compromised

If you use any service that could be connected to this stealer log, take action now. HEROIC's free breach scanner searches across more than 400 billion compromised records to tell you whether your email address or password has appeared in known data breaches and stealer log distributions. Checking takes only a few seconds and could prevent an account takeover before it happens.