Researchers Flag UHQ Mix Part 2 Log Exposing 99,850 Logins

In January 2023, HEROIC analysts flagged a stealer log file titled "UHQ MIX PART 2 1115," uploaded to a Telegram channel by an unidentified user. The file contained 99,850 records, each consisting of an email address, a plaintext password, and the URL of the login page the credentials were used on.

Why the UHQ Mix Part 2 Log Is Dangerous

Labeled as a "mix," this file appears to combine credentials gathered from multiple sources rather than a single target, giving whoever obtains it a broad range of accounts to attempt. Because the passwords are exposed in plaintext, there is no technical barrier between downloading the file and using the credentials against real accounts.

What Was Exposed in the UHQ Mix Part 2 Log

• Email addresses
• Plaintext passwords for each account
• URLs identifying the login pages tied to the credentials

Why This Matters

With nearly 100,000 credential pairs in a single file, attackers have enough volume to run automated credential stuffing attacks against a wide variety of websites at once. Anyone whose email appears in this log is at risk of account takeover if the associated password was reused elsewhere, which can lead to financial loss or identity theft depending on what the compromised account controls.

How Stealer Logs Work

This kind of file is built from info-stealing malware running on many separate infected devices, not from a breach of one company's systems. The malware, often delivered through pirated downloads or malicious attachments, quietly extracts saved credentials from browsers and reports back to the attacker. Sellers then combine results from multiple infections into a single "mix" file, split into numbered parts as this one was, before distributing it through Telegram channels and criminal marketplaces.

Check If You Are Affected

Given the scale of this log, it is worth checking your exposure directly. HEROIC's free breach scanner searches a database of more than 400 billion leaked records, including logs like this one, to tell you quickly whether your email address was affected.