One Telegram Upload. 12,800 Records. The pop.com.br Leak Went Public.

Stealer Log Tied to pop.com.br Exposes 12,800 Records

HEROIC analysts identified a stealer log file tied to pop.com.br that surfaced on a Telegram channel on June 10, 2026. The file contained 12,800 records, including email addresses, plaintext passwords, and the URLs of the accounts those credentials unlock. The data was posted directly to the channel, making it instantly available to anyone who found the upload.

Why This Is Dangerous

Unlike a breach where a company's database is hacked and passwords are usually encrypted, a stealer log captures what was sitting in a browser at the moment malware infected the device. That means the passwords in this file are stored in plaintext, exactly as typed. Paired with the matching URL, an attacker can go straight to the correct login page for each of the 12,800 accounts and try the credentials immediately.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the accounts the credentials belong to

Why This Matters

With 12,800 records in play, the odds are high that some people reused their password on other accounts. That opens the door to credential stuffing, where attackers try the same login across email, banking, and social media platforms. From there, account takeover, identity theft, and financial fraud become very real outcomes for anyone whose password habits were not unique to each site.

How Stealer Logs Work

A stealer log is created when malware, often hidden in a cracked program, fake download, or malicious attachment, infects a device and quietly copies everything saved in the browser: usernames, passwords, autofill data, and browsing history. That information is packaged into a log file and sent back to whoever controls the malware, then sold, traded, or uploaded to Telegram channels where anyone can access it for free.

Check If You Are Affected

If you think your email might be connected to pop.com.br or any other leak, HEROIC's free breach scanner checks your address against a database of more than 400 billion leaked records. Checking takes seconds and tells you exactly where you stand.