301 Files. One TOR_LOG Mix. 5,645 Stolen Logins Inside.

HEROIC analysts identified a stealer log package called TOR_LOG MIX 301PCS that a Telegram user uploaded in June 2024. The package is a bundle of 301 individual log files compiled into one mix, together containing 5,645 records of endpoint URLs, email addresses, and plaintext passwords. Why this is dangerous: each of the 301 files inside this mix represents data pulled from a separate infected device, meaning the credentials were captured while victims were actively using their real accounts. Because the passwords are stored in plaintext, anyone who downloads the mix can log directly into those accounts without needing to crack or guess anything. What was exposed: endpoint URLs showing which sites and services were accessed, email addresses, and plaintext passwords tied to each login. Why this matters: bundling stealer logs into a single mix like this makes it easier for criminals to sort through the data and pick out valuable accounts, from email and banking logins to shopping and streaming services. Anyone among the 5,645 records in this mix risks account takeover, financial fraud, or identity theft if the same password is reused anywhere else. How stealer log mixes work: a stealer log is generated when information stealing malware infects a device, often through a fake download, cracked software, or phishing link, and quietly harvests saved browser passwords and login sessions. Criminals then collect logs from many infected machines and combine them into a single mix, like this one packaging 301 separate files together, before selling or distributing the bundle through channels like Telegram. Check if you are affected: HEROIC's free breach scanner checks your email address against a database of more than 400 billion leaked records, including stealer log mixes like this one. Run a free scan to see if your credentials appear among the 5,645 exposed records and get guidance on securing any affected accounts.