The ArhontCorp Stealer Log Exposed 41,917 US User Accounts

In June 2026, HEROIC analysts identified a stealer log labeled BONUS FATETRAFFIC TG ArhontCorp.part1, uploaded to Telegram by an anonymous user. The file contains 41,917 records harvested from infected devices, including endpoints, email addresses, API host information, and plaintext passwords tied to accounts in the United States, dated 20 June 2026.

Why the ArhontCorp Stealer Log Puts US Accounts at Risk

Unlike a simple password list, a stealer log captures the exact device and site details a victim was logged into at the moment their computer was infected. For the 41,917 US accounts in this log, that means an attacker doesn't just get a password, they get the endpoint and API host needed to walk straight into the account without guessing.

What Was Exposed in the ArhontCorp Stealer Log

• Device endpoints
• Email addresses
• API host information
• Plaintext passwords
• Associated website URLs

Why This Matters for These 41,917 US Accounts

Stolen endpoint and API data is especially valuable for credential stuffing and session hijacking because it removes the guesswork attackers normally face. Anyone whose device was infected faces a heightened risk of account takeover, financial fraud, and identity theft across every service they were logged into when the malware struck.

How This Stealer Log Was Built

Stealer logs come from infostealer malware, malicious software that quietly installs on a victim's computer and copies saved passwords, browser cookies, and connection details before sending everything back to the attacker. The results are packaged into logs like this one and sold or shared on Telegram channels, often within days of the infection.

Check If You Are Affected

If your device was ever infected with infostealer malware, your credentials could already be circulating. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including this stealer log, so you can find out and reset your passwords immediately.