Was Your Data in the TOR_LOG MIX 301PCS Breach? 5,351 Records

HEROIC discovered 5,351 records exposed in the TOR_LOG MIX 301PCS stealer log breach on October 13, 2024. Despite sharing the 301PCS label with the October 15 drop, this earlier archive came from a different operator persona and carries a substantially larger 5,351-victim footprint, suggesting a separate harvesting infrastructure.

Why This Stealer Log Is Dangerous

Because two unrelated actors are recycling the 301PCS tag, defenders who only check for one instance will miss the other. This archive is roughly four times larger than its namesake two days later, meaning exposure probability is higher for any given user. Plaintext passwords and recorded URLs provide a clear attack roadmap.

What Was Exposed in TOR_LOG MIX 301PCS

• Email addresses covering personal, work, and catch-all inboxes
• Plaintext passwords captured at the moment of login
• URLs showing targeted web apps and internal portals
• API endpoint URLs useful for lateral movement
• System fingerprint data identifying specific hosts

The mix of consumer and enterprise URL patterns suggests the operator was not filtering victim type.

Why This Matters

Attacker personas matter when assessing risk. This operator appears to recycle a popular tag to improve visibility in crowded Telegram marketplaces, a reminder that log names are branding rather than provenance. Organizations should assume any recurring tag represents multiple independent archives and check each one.

How a Stealer Log Like TOR_LOG MIX 301PCS Works

Stealer binaries land via phishing attachments, drive-by downloads, or malicious NPM and PyPI packages. On execution they sweep Chromium, Firefox, and Gecko-based browsers for saved credentials, decrypt them using the logged-in user's DPAPI key, and upload the output. Operators relabel the output to match trending tags like 301PCS before redistributing.

Check If You Are Affected

HEROIC monitors the world's largest breach database with over 400 billion compromised records. Run a free scan to see if your email, passwords, or accounts appear in the TOR_LOG MIX 301PCS leak or other major breaches.