TOR_LOG 273logs Mix: 5,152 Stolen Credentials on Telegram

In March 2023, HEROIC analysts discovered a stealer log file circulating on Telegram containing 5,152 records from the TOR_LOG 273logs Mix collection. This dataset, uploaded by an anonymous Telegram user, contained endpoint data, email addresses, plaintext passwords, and URLs harvested from compromised devices. The TOR_LOG series is a large, ongoing collection of stealer log dumps shared across Telegram channels; related releases include the TOR_LOG 76logs BR and numerous other variants posted throughout 2023.

Why This Is Dangerous

Stealer logs are compiled by malware installed silently on victims' devices. The malware captures active browser sessions, saved credentials, and any passwords typed or autofilled during the infection window. Victims typically have no idea their credentials were harvested. Once these logs are shared on Telegram, they are rapidly downloaded by threat actors who use the data to access bank accounts, email inboxes, cloud storage, and workplace systems.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs (indicating which websites were targeted)

Why This Matters

Plaintext passwords extracted from stealer logs are immediately usable without any cracking. Threat actors use this data for credential stuffing attacks against banking portals, e-commerce accounts, and corporate VPNs. A single compromised email and password pair can cascade into account takeover across dozens of services if the victim reuses passwords. Identity theft and financial fraud are direct downstream risks.

How Stealer Logs Work

A stealer log is produced by infostealer malware, a category of malicious software that infects computers through phishing emails, malicious downloads, or compromised software installers. Once installed, the malware silently scans the device for saved browser credentials, cookies, and autofill data. It then packages everything into a compressed log file and transmits it to the attacker. These logs are often sold or freely shared in Telegram channels and dark web forums, where other criminals download and exploit them.

Check If You Are Affected

HEROIC's free breach scanner searches across more than 400 billion records in the DarkHive database, including stealer log collections like this one. If your email address or credentials appear in this or any related breach, you will be notified immediately so you can take action. Run your free scan at HEROIC.com and find out if your data has been exposed.

Related Parts of This Breach

This post is part of the broader TOR_LOG series shared via Telegram. Related releases include:

• TOR_LOG 76logs BR uploaded by a Telegram User