Inside the TOR_LOG MIX Leak: 5,010 U.S. Stealer Log Records Exposed

In April 2024, HEROIC analysts identified a stealer log file designated TOR_LOG MIX 251PCS, uploaded to a public Telegram channel by an anonymous threat actor. The dump contained 5,010 records tied to U.S.-linked endpoints, exposing email addresses, plaintext passwords, and URLs harvested from compromised machines. The presence of plaintext credentials -- a critical and all-too-common security failure -- made this leak immediately dangerous. HEROIC flagged this incident as high priority given how quickly such data is weaponized once it circulates on Telegram.

Why This Is Dangerous

Stealer log leaks are among the most actionable types of breach data for cybercriminals. Unlike hashed password dumps, plaintext credentials require zero cracking effort. Attackers can recieve this data and immediately begin credential stuffing attacks against email providers, banking platforms, and corporate VPNs. Because many users reuse passwords across multiple services, a single compromised endpoint can open doors to dozens of accounts. The TOR_LOG MIX dump was distributed openly on Telegram, meaning hundreds of threat actors may have already downloaded and weaponized this data before it was flagged.

What Was Exposed

• Email Addresses -- login identifiers used across web and corporate services
• Plaintext Passwords -- unencrypted credentials ready to use without cracking
• URLs -- API endpoints and visited sites revealing which services were targeted

Why This Matters

The TOR_LOG MIX dump is part of a broader and accelerating trend: infostealer malware quietly harvesting credentials from everyday devices and packaging them into sellable, shareable log files. The 251 seperate log files consolidated in this archive suggest a wide-ranging infection campaign, not a single targeted attack. For individuals and businesses in the United States, this means credentials used on work devices, home computers, or shared networks may have been silently exfiltrated. The exposure of API endpoint URLs also hints at potential access to backend systems -- not just consumer accounts.

How Stealer Log Attacks Work

Infostealer malware -- such as RedLine, Vidar, and Raccoon Stealer -- is typically delivered through phishing emails, malicious downloads, or compromised software installers. Once installed on a device, the malware silently scans browsers, email clients, and applications for stored credentials. It then packages everything into a log file and transmits it back to the attacker. The attack occured without any visible disruption to the user, making detection difficult. These logs are then consolidated, sold, or leaked on dark web markets and Telegram channels, where they circulate among hundreds of threat actors simultaneously.

Check If You Are Affected

If your email address or credentials were part of the TOR_LOG MIX 251PCS leak, your accounts may already be at risk. HEROIC's free scanner checks your email against 400 billion+ exposed records -- one of the largest breach databases available. Enter your email at HEROIC.com to instantly see if your data appeared in this leak or any other known breach. Early detection is the fastest way to secure your accounts before attackers act on the data.