How the ‘TestBase 3’ Stealer Log Leaked 9,978 Passwords Online

How the "TestBase 3" Stealer Log Ended Up With 9,978 Passwords

On 4 July 2026, HEROIC analysts identified a stealer log labeled "TestBase 3" uploaded to a Telegram channel, containing 9,978 records. Unlike the domain-specific logs analysts often see, this file is a mixed batch: each record pairs an email address with a plaintext password and the specific login URL it was used on, spanning a variety of different websites rather than a single company.

Why a Mixed Batch of 9,978 Credentials Is Dangerous

Because the records span many different sites, this log gives an attacker a diverse set of nearly 10,000 working logins to test across banking, email, retail, and social platforms simultaneously. Every password was captured in plaintext, meaning there is no encryption standing between the data and immediate misuse.

What Was Exposed

• Email addresses
• Plaintext passwords
• Login URLs across a variety of sites

Why a Batch Like This Fuels Widespread Fraud

Because the credentials in a mixed batch are not tied to one platform, they are especially useful for large-scale credential stuffing campaigns. Victims face a real risk of account takeover on whichever services they used, and where financial or shopping accounts are involved, potential financial fraud or identity theft.

How a Batch Like "TestBase 3" Gets Built and Named

Infostealer malware infects devices through pirated software, cracked games, or malicious downloads, then quietly exports every saved password, cookie, and autofill entry from the browser. Sellers on Telegram often compile these harvests into numbered or named batches, such as "TestBase 3," testing and refining their collection process before releasing larger volumes.

Check If You Are Affected

Because this log spans many different sites, anyone could be in it. HEROIC's free breach scanner checks your email against more than 400 billion breached and leaked records, including mixed stealer log batches like this one, so you can confirm your exposure in seconds.