Researchers Link sbg.at to 1,865 Stolen Credentials Found on Telegram

HEROIC analysts identified this stealer log on 10-Jun-2026. The breach exposed 1,865 records, with stolen data including email addresses, plaintext passwords, and URLs. The source is identified as sbg.at.

Why This Is Dangerous

Stealer logs distributed through private Telegram channels reach a wide network of cybercriminals before they ever appear on public dark web markets. By the time this data is found and indexed, it may have already been used in targeted account takeover attempts. The combination of email, password, and URL data gives attackers everything they need to log into victim accounts without any additional reconnaissance.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs (websites and services accessed by victims)

Why This Matters

Stolen credentials circulating on Telegram can be accessed by hundreds of threat actors within hours of being posted. Those actors use the data for a range of attacks including account takeover, identity fraud, business email compromise, and financial theft. The more widely a credential set spreads, the greater the ongoing risk to victims even years after the original theft occurred.

How Stealer Logs Work

An infostealer infection typically starts with a single bad click: a phishing email, a fake software download, or a compromised website. The malware activates and quietly harvests every saved username, password, and visited URL it can find on the device. The stolen information is formatted into a log and sent back to the attacker's infrastructure, often within minutes of infection. These logs are then packaged and shared in Telegram communities frequented by cybercriminals.

Check If You Are Affected

HEROIC offers a free breach scanner that searches 400 billion records. Search your email address now to see if your credentials appear here or elsewhere. Free, takes seconds.