SafeSocks5_botMIX: 2,388 Accounts Compromised by Infostealer Malware

HEROIC found the SafeSocks5_botMIX stealer log on June 3, 2023, a file exposing 2,388 records containing email addresses, plaintext passwords, and the URLs of services where those credentials were harvested from compromised devices. The log was distributed via Telegram as part of an infostealer campaign targeting user endpoints.

Why the SafeSocks5_botMIX Breach Is Dangerous

With 2,388 plaintext credentials exposed, attackers can immediately execute credential stuffing attacks against email providers, financial platforms, and social media services, bypassing authentication on any account where victims reused their passwords.

What Was Exposed in the SafeSocks5_botMIX Leak

• Email addresses
• Plaintext passwords
• URLs (the exact services where credentials were captured from infected devices)

Why This SafeSocks5_botMIX Data Puts You at Risk

Stealer log credentials enable credential stuffing, account takeover, identity theft, and financial fraud. Because passwords are exposed in plaintext, no decryption is needed and criminals can exploit the data immediately after it surfaces on Telegram.

How Stealer Log Works

Infostealer malware spreads through phishing emails, malicious downloads, and trojanized software. Once installed on a victim's device, it silently harvests saved credentials, session cookies, and browser autofill data. Attackers compile the stolen records into log files and post them on Telegram channels and dark web marketplaces.

Check If Your Data Was Exposed

HEROIC operates one of the world's largest breach databases, covering more than 400 billion leaked records. Use HEROIC's free breach scanner to check if your email address or credentials appeared in the SafeSocks5_botMIX leak or thousands of other breaches in our database.