One Telegram Upload. 17 Credential Sets. The 272218_DO Stealer Log Had Plaintext Passwords Inside.

HEROIC analysts confirmed a verified stealer log, tracked as 272218_DO_181.37.223.144_08-06-23, was uploaded to Telegram in June 2023. The file contained 17 records collected from endpoints in the Dominican Republic, exposing plaintext passwords, email addresses, and URLs. A single upload to a Telegram channel made all 17 credential sets immediately available to anyone with access to that channel, which in active threat communities can number in the thousands.

Why the 272218_DO Stealer Log Is Dangerous

The plaintext passwords in this file mean attackers need no additional tools to start using the stolen credentials. Each record also includes the email address that goes with the password and the URL of the affected service. That combination gives attackers everything they need to attempt account logins in seconds. Even a small file like this one can generate real damage when credentials are reused across multiple platforms.

What Was Exposed in 272218_DO

• Email Addresses
• Plaintext Passwords
• URLs (endpoint and API host references)

Why This Matters

Stealer logs distributed through Telegram channels move fast. Within hours of being posted, files like 272218_DO can be downloaded by dozens of threat actors who then use the credentials for credential stuffing, account takeover, and financial fraud. Victims who reuse their passwords face the highest risk, but even those who use unique passwords may find their email accounts targeted for phishing and social engineering attacks once attackers have their address.

How Stealer Log Breaches Like 272218_DO Work

Infostealer malware is designed to run invisibly on an infected device. It targets saved browser passwords, autofill credentials, and active login sessions, then packages everything into a structured log file. That file is delivered to the attacker automatically, who then decides whether to use the credentials personally or distribute them on Telegram or dark web forums. Every record in the 272218_DO file originated from a real person's infected device, likely without their knowledge.

Check If You Are Affected

HEROIC's free breach scanner searches more than 400 billion exposed records, including Telegram-distributed stealer logs like 272218_DO. Enter your email at HEROIC to instantly check whether your credentials appear in this breach or any other verified leak in the database.