How the TOR_LOG MIX 299PCS Malware Led to 4,540 Stolen Logins

Behind the file name TOR_LOG MIX 299PCS sits a simple chain of events: malware on someone's device, then 4,540 stolen logins on Telegram. HEROIC analysts confirmed the batch, uploaded on August 12, 2024, pairs plaintext passwords with email addresses and the URLs those logins open. The only way to know if you're affected is to scan your email.

Why Understanding the Source Changes How You Respond

This data didn't come from a company's systems being broken into. It came from malware reading saved logins directly off an infected device, which means the fix isn't just changing a password, it's making sure the device itself is clean first.

What Was Exposed

• Email Addresses: confirms account ownership and gives attackers a target for phishing.
• Plaintext Password: stored as readable text, usable immediately with no cracking needed.
• URLs: shows attackers exactly which login page each stolen password unlocks.

Why This Chain Leads to Real Losses

Once a password from this batch is confirmed to work, an attacker can use it to log in directly, then pivot to resetting other account passwords, making unauthorized purchases, or locking the real owner out entirely. Reused passwords are what let one infected device affect several accounts.

How Malware Turns One Device Into a Batch Like This

Infostealer malware typically arrives through a cracked program, fake download, or malicious attachment, then quietly reads saved browser passwords and the pages they belong to before sending that data to the attacker. Batches get numbered as they're released, which is how this 299 piece set got its name.

Is Your Device Behind the TOR_LOG MIX 299PCS Batch?

Scan the device you use to log into your accounts for malware before changing anything, since an active infection will simply capture new passwords again. Once it's clean, scan your email and update any exposed passwords from that clean device. Do this for personal and work logins alike, since one infected device often touches both.