Stealer Log Leak Exposes 1,604 Aut.ac.nz Passwords Online

In June 2026, HEROIC's dark web analysts spotted a stealer log posted to Telegram on 10-Jun-2026 containing 1,604 records tied to aut.ac.nz. The log held email addresses, plaintext passwords, and the URLs of the login pages those credentials were used on, evidence of malware that had been quietly siphoning saved logins off infected devices before the data was bundled up and shared online.

Why This Aut.ac.nz Stealer Log Leak Is Dangerous

Because each password in the file sits right next to the exact web address it was used on, whoever holds this log has a direct map for breaking into 1,604 accounts. There is no cracking or guesswork involved, only a matter of typing the credentials in and seeing which ones still work.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the sites the credentials were used on

Why This Matters

Plaintext passwords mean attackers can try them immediately, with no decryption step standing in the way. Since people frequently reuse the same password across school portals, email, and personal accounts, a single exposed login here can open the door to credential stuffing attacks against other unrelated sites, putting far more than just one account at risk.

How Stealer Logs Work

Stealer logs are the output of infostealer malware, malicious code that gets onto a device through a fake download, a cracked program, or a phishing email. Once active, it copies saved passwords and browsing data straight from the browser and sends it back to whoever is running the malware. The stolen information is then packaged into a text file and shared or sold, in this case dropped into a Telegram channel for anyone to grab.

Check If You Are Affected

If you have ever used an aut.ac.nz email address to log into anything, it is worth checking whether it turned up in this log. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records in seconds, so you can find out right away and change any exposed passwords before someone else uses them first.