The Redline FreeLogs 192 Leak: 8,409 Stolen Login Credentials

HEROIC analysts found a stealer log called "Redline FreeLogs 192" uploaded to a Telegram channel on December 16, 2022. The file exposed 8,409 records tied to U.S. users, including email addresses, plaintext passwords, and the API host URLs those credentials belong to.

Why This Redline Log Is Dangerous

The name points to Redline, a well known credential stealing malware family used to harvest saved logins directly from infected devices. Every password in this file was stored in plaintext, so an attacker can use each one immediately, and every password is paired with the exact URL it unlocks.

What Was Exposed in the Redline FreeLogs 192 Leak

• Email addresses
• Plaintext passwords
• API host URLs tied to each login

Why This Matters

A file of 8,409 working email and password pairs is a ready-made resource for credential stuffing attacks, where attackers test the same login across banking, email, and shopping sites. Anyone in this leak who reused a password elsewhere is at risk of account takeover, which can quickly lead to identity theft and financial fraud.

How Redline Stealer Logs Get Created

Redline is malware that infects a device and quietly harvests saved browser passwords, autofill data, and active login sessions. The stolen data is bundled into a log file, in this case named "Redline FreeLogs 192," and then shared or sold on Telegram, exactly how HEROIC found this file on December 16, 2022.

Check If Your Email Was Exposed

If you want to know whether your credentials appear in the Redline FreeLogs 192 log or any other leaked stealer log, HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records. Run a scan now to see if your information has surfaced.