The Mansory 10 Stealer Log Contains More Stolen Records Than You Think

HEROIC analysts identified this stealer log on 27-Dec-2025. The breach exposed 76,845 records, with stolen data including email addresses, plaintext passwords, and URLs. The source is identified as Mansory 10 uploaded by a Telegram User.

Why This Is Dangerous

Mansory 10 contains 76,845 email and password pairs, all in plaintext, meaning the passwords can be used directly without any cracking or decryption. The included URLs show which specific websites or services were targeted, giving attackers a targeted list of accounts to attempt to access. This combination of data is among the most immediately actionable for cybercriminals.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs

Why This Matters

Stolen email and password pairs are routinely used in automated credential stuffing attacks. Tools that try these credentials across dozens of popular services simultaneously can compromise many accounts in a short amount of time. Anyone who reuses passwords is at particularly high risk. Breaches like Mansory 10 are a direct contributor to account takeovers, identity theft, and financial fraud.

How Stealer Logs Work

A stealer log is a file produced by malicious software running on an infected computer. The malware silently captures every login entered in the browser, pulls saved passwords from the device, and notes the URLs of websites visited. These credential files are then packaged and distributed by criminals through Telegram channels and dark web forums.

Check If You Are Affected

HEROIC offers a free breach scanner that searches 400 billion records from known breaches. Search your email address now to find out if your credentials appear in this breach or others. The scan is free and takes seconds.