5,044 Records Exposed in TOR_LOG MIX 299PCS Stealer Log Breach

HEROIC discovered 5,044 records exposed in the TOR_LOG MIX 299PCS stealer log breach on September 30, 2024. The file was dropped on a private Telegram credential channel and contained email addresses, plaintext passwords, and API host URLs exfiltrated from infected endpoints.

Why This Stealer Log Is Dangerous

TOR_LOG MIX 299PCS is dangerous because plaintext passwords appear alongside the exact API hosts they authenticate to, which dramatically shortens the time from leak to active exploitation. The 299-piece batch naming also indicates an industrialized pipeline where this file is just one unit of a much larger ongoing distribution.

What Was Exposed in TOR_LOG MIX 299PCS

• Login credentials (usernames, passwords)
• Browser cookies and session tokens
• Autofill form data
• Crypto wallet data (where present)
• System fingerprints

API host URLs elevate this leak beyond consumer accounts, giving attackers a path to backend systems.

Why This Matters

Stealer logs are the fuel behind most modern account takeover campaigns, and mixed batches like 299PCS are traded by initial access brokers to ransomware affiliates. If your credentials are in this file, the risk is not only personal account abuse but potential corporate intrusion through reused work passwords.

How a Stealer log Like TOR_LOG MIX 299PCS Works

An infostealer executes on a victim endpoint after delivery through phishing or cracked software, then pulls saved browser passwords, cookies, autofill fields, and crypto wallet data. The operator packages 299 individual victim logs into a single mix and publishes it on Telegram for buyers and downstream scrapers.

Check If You Are Affected

HEROIC monitors the world's largest breach database with over 400 billion compromised records. Run a free scan to see if your email, passwords, or accounts appear in the TOR_LOG MIX 299PCS leak or other major breaches.