Your Brazilian Accounts May Be In The TOR_LOG BR Stealer Log Dump

HEROIC found 6,311 records on 28-Feb-2023 inside the TOR_LOG BR stealer log, a Brazil-region Tor stealer archive uploaded by a threat actor on Telegram. The dump contains email addresses, plaintext passwords, and login URLs pulled from infected endpoints across Brazil.

Why This Stealer Log Breach Is Dangerous

Brazil-region stealer logs are prime fuel for local account takeover campaigns targeting Pix, Mercado Livre, iFood, Nubank, and Brazilian government portals. The credentials are fresh and unsalted, and they are paired with the exact URLs where attackers can reuse them immediately.

What Was Exposed in TOR_LOG BR

• 6,311 compromised user records from Brazilian victims
• Email addresses tied to active Brazilian accounts
• Plaintext passwords requiring no cracking
• Full login URLs for Brazilian banking, commerce, and SaaS sites
• API host endpoints exposing backend systems

Why This Matters

If your Brazilian accounts use any password that ever touched an infected machine, TOR_LOG BR could put you one click from a drained bank account, hijacked email, or stolen social profile. Brazilian credential fraud rings aggressively test these dumps against Pix, government login gateways, and retail platforms within hours of release.

How a Stealer Log Like TOR_LOG BR Works

Infostealer malware such as RedLine, Raccoon, and Vidar spreads through cracked software, malicious ads, and phishing messages popular in Brazilian channels. Once on a device, it scrapes saved browser credentials, autofill data, cookies, and crypto wallet files, then compresses the haul. Channel operators filter logs by country code (BR) and repackage Brazil-specific dumps for local fraud crews.

Check If You Are Affected

HEROIC runs a 400B+ record breach intelligence database that ingests Brazil-region stealer logs like TOR_LOG BR as they surface. Run a free exposure check to see if your email or passwords are in this dump, then rotate credentials across every Brazilian service and enable phishing-resistant MFA.