Someone Has Your Discord Password: 93 Accounts Leaked

HEROIC analysts uncovered a stealer log file targeting Discord users on a Telegram channel in May 2026. The dataset contains 93 compromised records, each linking a Discord account email to a plaintext password and the login URL where the credential was intercepted. The file was generated by infostealer malware running on infected devices belonging to users in the United States.

Why Plaintext Discord Passwords Expose More Than Chat History

Discord has evolved far beyond a gaming chat platform. It now hosts professional communities, cryptocurrency groups, educational servers, and private business communications. When a Discord password is exposed in plaintext, attackers gain access to private channels, direct messages, file attachments, and connected integrations that may include sensitive or financial information.

Many Discord users link payment methods for Nitro subscriptions, server boosts, and app purchases. A compromised account can be used to make unauthorized charges, access premium content, or exploit connected accounts on platforms like Spotify, PlayStation Network, and Xbox Live that use Discord as a social layer.

What Was Exposed in the Discord Dump

• Email Addresses — Login identifiers tied to Discord accounts and connected services
• Plaintext Passwords — Fully readable credentials requiring no decryption
• URLs — Discord login endpoints confirming these are platform-specific credentials

Why 93 Discord Accounts Are Prized by Attackers

Hijacked Discord accounts are powerful tools for cybercriminals. Server administrators whose accounts are compromised can have their entire community taken over, with attackers using admin permissions to spread malware links, distribute phishing messages, and scam community members. Even regular user accounts are valuable for social engineering attacks against the victim's server contacts.

Discord's bot integration and webhook system means that a compromised account can also expose API tokens and automation credentials. Attackers who gain access to Discord developer accounts can weaponize bots to distribute malware across multiple servers simultaneously, reaching thousands of users from a single compromised account.

The 93 affected users should also consider the privacy implications. Private direct messages, shared files, voice chat histories, and server participation records all become accessible to the attacker. This information can be used for blackmail, identity correlation, or further targeted attacks against the victim's contacts.

How Stealer Logs Compromise Discord Accounts Silently

This Discord-focused dataset was created by infostealer malware that extracts saved credentials from web browsers and desktop applications. Discord users who log in through a web browser and save their credentials, or who use the desktop application on a compromised system, are both vulnerable to this type of data theft.

The malware commonly spreads through fake gaming tools, pirated software, malicious Discord bots, and phishing links shared within Discord servers themselves. This creates a self-reinforcing attack loop where compromised accounts are used to distribute the very malware that compromised them, infecting additional users and harvesting more credentials.

Beyond passwords, some infostealers also target Discord session tokens stored on the device. These tokens can be used to access an account without even knowing the password, bypassing two-factor authentication in some configurations.

Check If Your Discord Credentials Were Exposed

If you use Discord and have saved your password in a web browser or logged in on a device that may have been compromised, your credentials could be part of this or similar stealer log distributions. HEROIC provides a free breach scanner that checks your email against more than 400 billion compromised records.

Scan your email with the HEROIC breach scanner to find out if your Discord or other accounts have been exposed. If your credentials appear in any known breach, change your Discord password immediately, enable two-factor authentication, review your authorized applications list, and regenerate any bot tokens associated with your account.