Search Your Email: The SafeSocks5_botMIX Stealer Log Has 3,400 Records

HEROIC analysts identified a stealer log called SafeSocks5_botMIX, uploaded by a Telegram user on 31 December 2023. The file contains 3,400 records harvested from infected devices, including email addresses, plaintext passwords, and the URLs of the sites those credentials belong to.

Why This Is Dangerous

Search your email: the SafeSocks5_botMIX dump exposed 3,400 accounts, and because the credentials were captured directly off infected machines rather than pulled from an old company breach, they are more likely to still be valid today. The "bot mix" naming suggests the log was gathered and packaged through an automated collection process rather than a single targeted attack, which is common for large-scale stealer operations.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the websites and services tied to each login

Why This Matters

Because the passwords were captured in plaintext straight from a browser, no cracking is needed for an attacker to try logging in immediately. Anyone among these 3,400 records who reused a password across other accounts risks having email, banking, or shopping logins compromised well beyond the original exposure, a common path to credential stuffing and identity theft.

How Stealer Logs Work

Info-stealing malware infects a device, often bundled with cracked software, fake cheats, or malicious downloads, then silently harvests saved browser passwords, autofill data, and session cookies without the user's knowledge. The collected data is compiled into a "log" and distributed in mixed batches like this one on Telegram channels, where buyers and other criminals pick through the records for credentials they can use or resell.

Check If You Are Affected

HEROIC's free breach scanner checks your email against more than 400 billion leaked records, including stealer log mixes like this one. Search your email now and change any passwords tied to accounts that show up as exposed.