The skull_roses Dump: 20,566 Stolen Logins Hit the Dark Web

HEROIC analysts identified the skull_roses 582count stealer log package circulatig in private Telegram channels in July 2025. The dump contains 20,566 records harvested from 582 compromised devices, making it one of the larger individual batches in this wave of stealer log activity. Each record includes an email address, a plaintext password, and the URL of the login target, giving attackers everything they need to attempt immediate account takeover across thousands of victims.

Why This Is Dangerous

The skull_roses dump does not contain scrambled or encrypted passwords. Every password in this file is in plaintext, readable by anyone who opens it. That is the defining characteristic of stealer log data that makes it far more dangerous than a typical database breach. An attacker does not need technical skills to exploit it. They download the file, load the credentials into an automated tool, and begin testing logins against banks, email services, and social media platforms within minutes. The URLs included in each record identify exactly which sites each victim used, so attackers can prioritize the highest-value targets first.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs (specific sites and services each victim was logged into)

Why This Matters

Each of the 20,566 records in this dump represents a real person whose credentials are now accessible to anyone who downloads the file from Telegram. Attackers use these credentials for credential stuffing, where automated tools test each login across dozens of platforms simultaneously. Because most people reuse the same password across multiple accounts, a single exposed record can cascade into a compromised bank account, a hijacked email, or a stolen identity. For victims, the damage often goes unnoticed for weeks until financial fraud or unexpected account lockouts surface. The scale of this dump, 582 seperate infected devices worth of data, means the threat is broad and the window for attackers to act is already open.

How Stealer Logs Work

The name skull_roses is the handle of the threat actor or Telegram channel operator who organized this batch. The 582count label indicates 582 individual device logs were bundled into this release. The underlying malware that collected this data was distributed through phishing campaigns, fake software cracks, or malicious browser extensions. Each time a device was infected, the malware silently extracted saved browser passwords, autofill data, session cookies, and a record of every URL the browser had stored credentials for. These logs were then aggregated, packaged, and uploaded to a private Telegram channel for distribution among other threat actors. Victims never recieve any notification that their device was compromised or that their credentials are now available online. This type of operation has become a routine part of the underground economy, with new batches released daily across hundreds of channels.

Check If You Are Affected

HEROIC's free dark web scanner searches more than 400 billion leaked records, including stealer logs like the skull_roses 582count batch. If your email address was captured by the malware in this campaign, our scanner will find it. Enter your email at HEROIC.com to receive a free instant report showing every breach your data has appeared in. Knowing whether your data is in this dump is the first step to protecting your accounts before an attacker gets there first.

Visit HEROIC.com to run your free scan now.