Researchers Link pressenter.com Leak to 917 Stolen Login Credentials

Stealer Log Tied to pressenter.com Exposes 917 Records

HEROIC analysts identified a stealer log file tied to pressenter.com that surfaced on a Telegram channel on June 10, 2026. The file contained 917 records, including email addresses, plaintext passwords, and the URLs of the accounts those credentials unlock. The upload was freely accessible in the channel, meaning any member could download the file the moment it appeared.

Why This Is Dangerous

This information came from malware sitting on an infected device, not a hacked company server, which is why the passwords in this file are plaintext rather than hashed. Paired with the matching URL, an attacker knows exactly which login page each password belongs to and can attempt to use it without any extra research.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the accounts the credentials belong to

Why This Matters

If any of these 917 people reused their password on another account, an attacker can use credential stuffing to try it on email, banking, or social media logins. That single reused password can lead to account takeover, identity theft, and financial fraud, all stemming from one small file.

How Stealer Logs Work

A stealer log is created when malware, often hidden inside a cracked program, fake download, or malicious attachment, infects a device and quietly collects everything saved in the browser: usernames, passwords, autofill data, and browsing history. That data is packaged into a log file and sent back to whoever controls the malware, then sold, traded, or uploaded to Telegram channels where anyone can access it.

Check If You Are Affected

If you think your email could be tied to pressenter.com or any similar leak, HEROIC's free breach scanner checks your address against a database of more than 400 billion leaked records. It takes seconds to check and gives you a clear next step.