Search Your Email: TOR_LOG Stealer Exposed 3,421 Accounts on Telegram

In November 2023, HEROIC analysts identified a stealer log shared by an anonymous Telegram user containing 3,421 compromised records. The upload, labeled "TOR_LOG 267pcs," was discovered on November 9th, 2023. The data contained plaintext passwords, email addresses, and the URLs of the services where those credentials were used, all harvested directly from real people's infected devices and then distributed publicly on Telegram. If your email address is in this dataset, an attacker already has your password and knows exactly which website to use it on.

Why the TOR_LOG Stealer Is Dangerous

The TOR_LOG upload is dangerous for a specific reason: the passwords are plaintext. There is no hashing, no encryption, no cracking required. Anyone who downloaded the file from Telegram got a ready-to-use list of working credentials. The inclusion of URLs alongside each email-password pair means attackers know exactly where each stolen login goes. An attacker does not need to guess or experiment. They just need to open the file and start typing.

What Was Exposed

The TOR_LOG stealer log contained the following data types for each of the 3,421 affected records:

• Email Addresses
• Plaintext Passwords
• URLs (the exact websites where each stolen credential was being used)

Why This Matters

Stealer log victims face a tighter threat window than victims of traditional database breaches. When a company database is hacked, passwords are usually hashed, and defenders often have days or weeks before any accounts are compromised at scale. With a stealer log, the passwords are already usable the moment the file is posted. The 3,421 records in the TOR_LOG dump were shared on a public Telegram channel, meaning they were accessable to thousands of people before most victims had any idea their device had ever been infected. Credential stuffing attacks can begin within hours of a Telegram post going live.

How Stealer Logs Work

Infostealer malware typically arrives through phishing emails, pirated software downloads, and malicious browser extensions. Once on a device, it silently harvests saved passwords from Chrome, Firefox, Edge, and other browsers, along with session cookies and stored autofill data. The harvested data is sent to an attacker's server, where it is compiled into structured log files. These files are labeled, bundled, and distributed through private and public Telegram channels. The "267pcs" designation on this TOR_LOG upload indicates 267 seperate log bundles were combined, meaning the data came from hundreds of individual infected machines. The breach occured at the device level, not at any single company's server, which is why individual users are the primary victims and why standard breach notifications rarely accompany these events.

Check If You Are Affected

Search your email in HEROIC's free breach scanner, which covers more than 400 billion records from thousands of known leaks. The TOR_LOG stealer log is indexed in our database. If your email appeared in this upload or in any other known breach, our tool will tell you what was exposed and from which source. Enter your email at HEROIC now to find out if your credentials are circulating on Telegram or elsewhere on the dark web.