The TOR_LOG MIX 299PCS Leak: 4,746 Logins Quietly Hit the Dark Web

HEROIC analysts identified a stealer log file named TOR_LOG MIX 299PCS circulating on Telegram, dated to June 2024. The file contains 4,746 records of endpoints, email addresses, and passwords harvested directly from infected devices, exactly the kind of data an information-stealing malware program collects before sending it back to whoever controls it.

Why the TOR_LOG MIX 299PCS Leak Is Dangerous

Unlike an old breach dump, stealer logs capture whatever was saved in a victim's browser at the moment of infection, so the passwords and login pages inside tend to be current and working. That makes this kind of file especially attractive to attackers looking for accounts they can log into right now rather than credentials that may have already been changed.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated URLs

Why This Matters to You

If your device was ever infected with the malware behind this log, whatever you had saved in your browser at that time is now potentially in the hands of a stranger. That opens the door to account takeover, credential stuffing against your other accounts, and identity theft if enough personal details are attached to the exposed logins.

How a Stealer Log Like TOR_LOG MIX 299PCS Gets Made

Stealer logs start with malware that infects a device, often through cracked software, fake installers, or phishing links. Once running, it quietly scans the browser for saved passwords, autofill data, and cookies, then sends everything to a server the attacker controls. Logs from many infected machines are often bundled together, sometimes with a number like "299PCS" in the name to signal how many victim logs are included, and then shared or sold on Telegram.

Check If Your Credentials Are in This Dump

You do not have to wonder whether your device contributed to a log like this one. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records. Run a scan now to see if you're affected, and if you are, change your passwords and run a malware scan on your device right away.