The skull_roses Telegram Leak Exposed 26,068 US-Linked Accounts on the Dark Web

In July 2025, HEROIC analysts linked a Telegram stealer log series to the handle skull_roses, specifcally the 524-count collection. The confirmed dump contained 26,068 records harvested from compromised devices, with the majority of exposed accounts tied to US-based endpoints and services. Exposed data includes email addresses, plaintext passwords, and the URLs of every website and API host those infected machines were communicating with at the time of compromise.

Why This Is Dangerous

At 26,068 records, the skull_roses dump is large enough to sustain a prolonged campaign of targeted account takeovers. US-linked accounts are among the most actively traded credentials on dark web markets because they provide access to high-value financial platforms, e-commerce services, and enterprise software used predominantly by American users. With plaintext passwords and matching service URLs in the same file, attackers have everything needed to immediately exploit each stolen identity without any additional research or guesswork.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs (website endpoints and API hosts)

Why This Matters

US-based credentials fetch premium prices in underground markets because they unlock high-value targets: American banking platforms, investment accounts, healthcare portals, and major retail sites. At 26,068 records, the skull_roses collection is substantial enough to fuel automated credential stuffing campaigns across dozens of platforms simultaneously. Victims who reused passwords face cascading account compromise. Those with unique passwords still face risk from exposed email addresses, which are used for targeted phishing, identity theft, and fraudlent account recovery attempts that can persist for months before detection.

How Stealer Logs Work

Infostealer malware is a category of malicious software specifically designed to silently harvest credentials from infected computers and phones. It typically enters a device through a phishing link, a fake software installer, or a malicious browser plugin. Once active, it collects saved passwords, session cookies, and logs of network activity. All of that information is bundled into a structured log file and sent back to the attacker. Collections like the skull_roses dump are then distributed on Telegram in batches, often as part of larger archieve series sold or traded within underground communities targeting US-based platforms and users.

Check If You Are Affected

HEROIC's free scanner searches your email address against a database containing more than 400 billion compromised records, including US-linked stealer log files like the skull_roses collection and thousands of other known breaches. If your credentials show up in any known dump, you will be notified imediately so you can secure your accounts before an attacker does. Start your free scan at HEROIC.com now.