Search Your Email: ARCEUSULP 120 Exposed 669,924 Stolen Accounts

HEROIC analysts identified a stealer log dataset circulating on Telegram in June 2026 that exposed 669,924 records. The file, part of a series labeled ARCEUSULP 120, contains email addresses, plaintext passwords, and URLs captured by information-stealing malware from hundreds of thousands of infected devices. The scale of this dataset positions it among the more significant stealer log dumps tracked by HEROIC this year.

Why 669,924 Email and Password Pairs Signal a Mass Credential Theft Operation

A stealer log containing nearly 670,000 records is not the work of a single actor targeting individuals. Datasets of this size are assembled through coordinated malware distribution campaigns that infect large numbers of devices simultaneously. Each record includes the victim's email, their password in plaintext, and the URL where those credentials were captured, giving attackers an immediately usable credential-stuffing resource.

What the ARCEUSULP 120 Leak Exposed

• Email Addresses
• Plaintext Passwords
• URLs (login endpoints from which credentials were harvested)

The Scale of This Breach and Its Credential Stuffing Potential

With nearly 670,000 records, this dataset gives threat actors a substantial pool of credentials to test across banking portals, email providers, streaming services, and social media platforms. Automated credential stuffing tools can cycle through hundreds of thousands of login attempts per hour, meaning even a small percentage of successful matches translates to thousands of compromised accounts.

How Stealer Log Breaches Work

Stealer logs are produced by malicious software installed on victims' computers, often bundled with pirated software, game cheats, or delivered through phishing campaigns. Once installed, the malware silently records every username, password, and URL visited by the victim. The collected data is exfiltrated to a command-and-control server and later compiled into bulk datasets like ARCEUSULP 120, which are then distributed or sold through Telegram channels and criminal marketplaces.

Check If Your Data Was Exposed

HEROIC's free breach scanner indexes more than 400 billion exposed records, including datasets from stealer log campaigns like this one. Enter your email to see whether your credentials appear in this file or any other breach in our database, and get ahead of potential account takeovers before they happen.