One File Named TOR_LOG MIX 299PCS Held 4,717 Stolen Credentials

TOR_LOG MIX 299PCS: 4,717 Credentials Pulled From Infected Devices

In July 2024, HEROIC analysts identified a stealer log file named "TOR_LOG MIX 299PCS" shared with a Telegram audience. The "299PCS" in the name refers to the batch of infected devices the data was pulled from, and together they produced 4,717 records pairing email addresses and plaintext passwords with the URLs where each login was captured.

Why This Is Dangerous

Because this data comes directly from malware running on the victims' own devices, it reflects logins that were active and working at the moment of infection, not old, possibly-changed credentials from a years-old breach. With passwords stored in plaintext and matched to the exact URL they were used on, an attacker can move straight from opening the file to attempting a login, with no extra effort required.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs

Why This Matters

Because the name references Tor, the software many people use to browse anonymously, some of the accounts in this batch likely belong to users who believed their activity was hidden. Regardless of intent, the same risks apply to everyone in the file: credential stuffing against other accounts, direct account takeover, and identity theft if enough personal detail is tied to the exposed logins.

How Stealer Logs Work

Infostealer malware infects a device, often bundled with pirated software, cracked tools, or a malicious download, and then quietly harvests saved passwords, browser session data, and autofill details before sending everything back to the attacker in a text file. Sellers frequently combine the output from multiple infected devices into a single "mix" file like this one, labeling it with the device count to advertise its size before offering it up on Telegram or dark web forums.

Check If You Are Affected

If you want to know whether your information turned up in this leak, HEROIC's free breach scanner checks your email address against more than 400 billion leaked records, including stealer logs like this one. It takes only a moment to search, and finding out now means you can secure any exposed account before someone else gets to it first.