The skull_roses Leak: 28,371 Passwords Exposed. Yours Might Be One.

In July 2025, a threat actor operating under the name skull_roses uploaded a stealer log bundle to Telegram containing 28,371 compromised records. Every single one of those records included a plaintext password, an email address, and the URL of a service the victim was actively using at the moment their device was infected. HEROIC analysts verified the breach and indexed it for dark web monitoring. If you have not checked whether your credentials were in this dump, now is the time.

Why This Is Dangerous

Most leaked password databases require attackers to crack hashed passwords before they are usable. Not this one. The skull_roses log contains plaintext passwords, meaning every credential is immediately ready to deploy. Attackers do not recieve a puzzle to solve; they recieve a working key to a real account. With 28,371 of those keys available, threat actors can run automated credential stuffing campaigns against email providers, banking portals, corporate VPNs, and social platforms within hours of downloading the file. The URLs included in each record make it even easier, as they reveal exactly which services each victim was using and where to strike first.

What Was Exposed

HEROIC confirmed the following data types were present across all records in the skull_roses dataset:

• Email Addresses
• Plaintext Passwords
• URLs (active service endpoints accessed from each infected device)

Why This Matters

The skull_roses data was uploaded in July 2025, which means it is recent, actively circulating, and almost certainly being used right now. Unlike older breach dumps that have been partially acted upon, fresh stealer logs from 2025 contain credentials that many victims have not yet changed. Anyone whose email and password appeared in this dataset who has not rotated their credentials is still fully exposed. The risk multiplies for anyone who definately reuses the same password across multiple accounts, since one compromised credential can unlock banking, email, and workplace systems in a single automated sweep.

How Stealer Logs Work

The skull_roses log was built from 644 seperate device infections. Each infection began with infostealer malware delivered through a phishing email, a trojanized software download, or a malicious browser extension. Once installed, the malware silently extracted every password saved in the victim's browser, captured active session cookies, and logged every URL the victim visited. That data was compiled into an individual log file and transmitted automatically to skull_roses infrastructure. The 644 individual logs were then bundled and uploaded to Telegram, where they became available to anyone monitoring the channel. Victims typically have no idea their device was infected until accounts start showing signs of unauthorized access.

Check If You Are Affected

HEROIC's free dark web scanner searches across 400 billion+ leaked records, including the skull_roses stealer log bundle. If your email or passwords appeared among these 28,371 exposed records, or in any other breach in the HEROIC database, you will be alerted immediately. Do not wait to find out the hard way. Visit heroic.com to run your free scan now.