SMTP Test Leak Means 1,701 Email Accounts Are Ready to Steal

HEROIC identified a stealer log file labeled SMTP Test, uploaded to Telegram in March 2025, containing 1,701 compromised credential records. The "SMTP Test" label indicates these credentials have been specifically tested for email server access — meaning attackers have verified they can use these credentials not just to read emails but to send messages from the compromised accounts, enabling phishing attacks that appear to come from trusted senders.

Plaintext Passwords Plus SMTP Access Is a Dual Threat

Every password in this dump is stored in plaintext, and the SMTP testing means these credentials have been validated for mail server authentication. This combination creates a dual threat: attackers can both access your inbox and impersonate you by sending emails from your account. Phishing emails sent from a real, trusted email address are far more effective than those from unknown senders.

What Was Exposed

• Email Addresses — accounts verified for SMTP access, enabling both reading and sending capabilities
• Plaintext Passwords — unencrypted credentials that grant full email server access
• URLs — the mail servers and web portals associated with each compromised account

SMTP-Validated Credentials Enable Advanced Attacks

Beyond simple credential stuffing, SMTP-validated credentials unlock sophisticated attack chains. Attackers can use compromised accounts to send targeted phishing emails to the victim's contacts, distribute malware through trusted email addresses, intercept password reset emails for other services, and conduct business email compromise attacks. The 1,701 SMTP-tested accounts in this dump are primed for these high-impact scenarios.

How Infostealer Malware Feeds the SMTP Pipeline

This data originates from infostealer malware that captured credentials from infected devices. What distinguishes this collection is the post-processing: after the raw credentials were harvested, threat actors ran them through SMTP validation tools that confirmed which accounts allow authenticated email sending. This curation step transforms raw stealer logs into a weaponized toolkit for email-based attacks, making the collection far more dangerous than an untested credential dump.

Check If Your Credentials Were Exposed

The SMTP Test collection is now indexed in the HEROIC data breach scanner. With over 400 billion records in its database, HEROIC can instantly check if your email or password appears in this or any other breach. Given the SMTP-validated nature of these credentials, the risk of email impersonation is particularly high. Search now, change your email password immediately, review your sent folder for unauthorized messages, and enable two-factor authentication.