The TOR_LOG BR Leak Exposed 2,525 Brazilian Region Accounts on Telegram

What HEROIC Analysts Found in the TOR_LOG BR Stealer File

HEROIC analysts identified a stealer log file uploaded to Telegram in September 2023 under the name TOR_LOG BR. The file exposed 2,525 records harvested from compromised devices, including email addresses, plaintext passwords, and URLs showing which services those individuals were using at the time of infection. The BR designation in the file name is a common shorthand indicating Brazilian or Brazil-region origin, suggesting the infected devices were primarily located in that region.

Why Country-Targeted Stealer Logs Pose a Concentrated Regional Risk

Stealer log collections labeled with a country code are not accidental. Malware operators often target specific regions and organize logs by geography to make them more valuable to buyers who want to target users in a particular country. A file labeled BR allows anyone who purchases or downloads it to focus credential stuffing attempts on Brazilian-market services, banking portals, and regional platforms where those email addresses are most likely to have active accounts.

For the 2,525 people represented in TOR_LOG BR, this means their credentials may be in the hands of attackers specifically targeting Brazilian accounts. Regional banks, government portals, local e-commerce platforms, and social media accounts popular in Brazil are all likely targets.

What Was Exposed in the TOR_LOG BR Telegram Upload

• Email addresses from what appear to be Brazilian region users
• Plaintext passwords with zero encryption
• URLs identifying the specific services victims were actively using

Why TOR_LOG BR Creates Direct Risk for Account Takeover and Identity Theft

When email addresses and plaintext passwords from a specific region are bundled together, attackers can run highly focused campaigns. They know the demographic. They know which banks and services are popular in that region. And they have working credentials to test against those platforms immediately.

Beyond credential stuffing, the combination of a known email address and a working password enables attackers to reset accounts across linked services, intercept two-factor authentication codes sent to compromised email inboxes, and impersonate victims in financial transactions. Identity theft becomes considerably easier when the attacker already controls the victim's primary email account.

How the TOR_LOG Format Is Used by Malware Operators

Files named with TOR_LOG follow a naming convention used by certain infostealer operations to indicate logs collected from endpoints using anonymizing networks, or simply as a labeling convention for organized bundles. The malware itself operates like any infostealer: it infects a device, silently harvests credentials from the browser's saved password store, captures session tokens, and records which URLs the user visits. The infected user typically notices nothing unusual while this occured in the background.

Once the data is collected, it is bundled and uploaded to Telegram for distribution. Files are often shared in channels with thousands of subscribers, meaning the 2,525 records in TOR_LOG BR were immediately accessable to a large audience of potential attackers the moment they were uploaded in September 2023.

Check If Your Credentials Appeared in the TOR_LOG BR Leak

HEROIC's free breach scanner searches more than 400 billion exposed records, including stealer logs like TOR_LOG BR distributed through Telegram channels. If your email address or any password you use appeared in this upload, a free scan will flag it immediately. Run a search at HEROIC and find out whether your credentials are circulating on the dark web right now.