Breach Update: TOR_LOG MIX 299PCS Releases 4,835 Records (June 4, 2024)

HEROIC discovered 4,835 records exposed in the TOR_LOG MIX 299PCS stealer log breach on June 4, 2024. The 299-piece mixed-source archive combined credentials harvested from dark-web browsing sessions and standard web logins across hundreds of compromised endpoints, then surfaced on Telegram.

Why This Stealer Log Is Dangerous

The MIX label signals that these 299 device archives were not filtered to a single service, so attackers gain a broad, reusable credential-stuffing seed list. Plaintext passwords accompany each email and URL, making it trivial to automate login attempts at scale. Any Tor-related sessions captured in the logs also expose browsing context that fraudsters use for targeted phishing.

What Was Exposed in TOR_LOG MIX 299PCS

• Login credentials (usernames, passwords)
• Browser cookies and session tokens
• Autofill form data
• Crypto wallet data (where present)
• System fingerprints

Each of the 4,835 records maps a victim email to a plaintext password and the URL where the credential was harvested.

Why This Matters

Mixed-source logs are especially useful to attackers because they cover email, banking, SaaS, and crypto logins in a single file. A single password reuse across personal and business accounts lets attackers pivot from one breached service into corporate email or cloud consoles. The presence of cookies further enables session replay attacks that bypass two-factor authentication.

How a Stealer Log Like TOR_LOG MIX 299PCS Works

Operators distribute infostealer families through cracked software, fake updates, and malicious Telegram file shares. The malware copies browser-stored credentials, cookies, autofill data, and wallet extension files from each infected device, then uploads the archive to a central operator server. When the operator has collected 299 new device archives, they release the batch as a versioned MIX drop to grow Telegram subscribers.

Check If You Are Affected

HEROIC monitors the world's largest breach database with over 400 billion compromised records. Run a free scan to see if your email, passwords, or accounts appear in the TOR_LOG MIX 299PCS leak or other major breaches.