SafeSocks5_bot Stealer Log: 3,350 Records Exposed in 2023

HEROIC analysts identified a stealer log upload tied to the Telegram-distributed tool known as SafeSocks5_bot, with the exposure traced back to March 2023. The dataset contained 3,350 records harvested from infected endpoints, including email addresses, plaintext passwords, and associated URLs. The data was collected by malware silently running on victims' machines before being packaged and distributed through Telegram channels frequented by cybercriminals.

Why This Is Dangerous

Stealer logs aggregated through tools like SafeSocks5_bot give attackers immediate, ready-to-use credentials. Because the passwords are in plaintext and paired with the exact URLs where they were used, criminals can log directly into those accounts without any additional cracking. Victims who reuse passwords across services face compounding exposure: a single stolen credential can unlock email accounts, banking portals, and social media profiles simultaneously.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs (the specific sites where credentials were used)

Why This Matters

Credentials stolen by stealer malware flow almost immediately into criminal marketplaces and Telegram channels. From there, attackers use them for credential stuffing attacks against major platforms, account takeover fraud, identity theft, and financial crimes. The inclusion of URLs makes these logs particularly actionable because attackers know exactly which site each password belongs to, removing all guesswork.

How Stealer Logs Work

Stealer malware is a category of malicious software designed to silently harvest credentials from an infected device. Once installed, often through phishing emails, malicious downloads, or cracked software, the malware scans browsers, password managers, and applications for saved login data. It then packages everything into a structured log file and transmits it to the attacker. Telegram bots like SafeSocks5_bot serve as distribution channels, making it easy for criminals to sell or share these logs with minimal technical overhead.

Check If You Are Affected

If you used any service whose credentials may have passed through a compromised device between 2022 and 2023, your data could be in this dataset. HEROIC's free breach scanner checks your email against a database of over 400 billion exposed records, including stealer log compilations like this one. Search now to find out if your credentials have been compromised and take action before attackers do.