Tor Browser Users Targeted in the TOR_LOG MIX 3,762 Record Leak

In June 2024, HEROIC's threat intelligence analysts identified a stealer log file uploaded to Telegram by an anonymous user, tracked as "TOR_LOG MIX 299PCS uploaded by a Telegram User." The "299PCS" label indicates the file is a mix of 299 separate stealer logs combined into one collection, together containing 3,762 records of endpoints, email addresses, API hosts, and plaintext passwords, along with the login URLs those credentials belong to.

Why This Is Dangerous

Because this is a stealer log rather than an old breach compilation, the credentials inside come straight from devices infected with malware, including devices running Tor, often used by people who specifically value their privacy. Combining 299 individual logs into one file means an attacker gets 3,762 sets of working email addresses, plaintext passwords, and exact login URLs in a single download, with no cracking or guessing needed.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs linked to each credential pair

Why This Matters

People who use privacy tools like Tor often assume their online activity is well protected, but a stealer log doesn't care what browser you use. It captures whatever is saved on the infected device itself. If your credentials are among these 3,762 records and you've reused a password elsewhere, an attacker can move from that one infected device into your email, financial accounts, or other services, leading to account takeover or identity theft.

How Stealer Logs Work

Stealer logs are generated by malware that infects a device, often through a malicious download, and then silently harvests saved passwords, cookies, and autofill data from the browser. Sellers frequently combine many small logs into a single "mix" file, as this 299-piece collection does, to offer buyers a larger batch of fresh credentials in one purchase, then distribute it through channels like Telegram.

Check If You Are Affected

Regardless of which browser or privacy tools you use, it's worth checking whether your credentials show up in a leak like this one. HEROIC's free breach scanner searches more than 400 billion exposed records, including this leak, so you can find out in seconds and update any exposed passwords before someone else uses them.