The Mansory 4 Leak Data Just Went Public on the Dark Web

HEROIC analysts identified this stealer log on 17-Dec-2025. The breach exposed 1,780,435 records, with stolen data including email addresses, plaintext passwords, and URLs. The source is identified as Mansory 4, uploaded by a Telegram user.

Why This Is Dangerous

This stealer log contains plaintext passwords, meaning the passwords were never encrypted. Anyone with access to this file can immediately use the stolen email and password combinations to attempt logins across hundreds of websites and services. With 1,780,435 credential pairs now in criminal hands, the risk of unauthorized account access is significant.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs (website addresses associated with each credential)

Why This Matters

When stolen email and password pairs from the Mansory 4 leak circulate on the dark web, criminals use them for credential stuffing attacks. This means they run automated tools that try each stolen username and password across popular websites, banking portals, and email providers. If you use the same password on more than one site, a single exposed credential can lead to account takeovers, identity theft, and financial fraud.

How a Stealer Log Works

Stealer logs are created by malicious software that secretly installs itself on a victim's device, often through a fake download, phishing link, or infected file. Once running, the malware quietly collects every username, password, and web address stored in the device's browser or applications. This data is then bundled into a log file and sold or shared in criminal marketplaces and private Telegram channels.

Check If You Are Affected

HEROIC offers a free breach scanner that searches 400 billion records. Search your email address now to see if your credentials appear here or elsewhere. Free, takes seconds.