The Supercell Inbox Leak: Someone Could Be Logging Into Your Accounts

HEROIC analysts identified this stealer log on 04-Apr-2024. The breach exposed 43 records, with stolen data including email addresses, plaintext passwords, and URLs. The source is identified as 40x Supercell Inbox.

Why This Is Dangerous

The 40x Supercell Inbox stealer log contains 43 plaintext email and password pairs taken directly from infected devices. Supercell accounts manage access to games like Clash of Clans, Brawl Stars, and Clash Royale, where players often link credit cards and spend real money on in-game purchases. A stolen Supercell login can give an attacker direct access to those linked payment methods and stored game progress.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs

Why This Matters

Even 43 stolen credentials represent real accounts belonging to real people. Criminals test each login against the original service and then attempt the same email and password combination against email providers, banking apps, and other accounts where users commonly reuse passwords. A single match can trigger a chain of unauthorized access across multiple platforms.

How a Stealer Log Works

A stealer log is created when malware infects a device and silently records saved passwords, login URLs, and browser session data. That information is packaged into a file and shared through underground Telegram channels, where criminals use it to attempt unauthorized logins. The 40x Supercell Inbox log targeted gaming account holders specifically.

Check If You Are Affected

HEROIC offers a free breach scanner that searches 400 billion records from known breaches. Search your email address now to find out if your credentials appear in this breach or others. The scan is free and takes seconds.