One TOR_LOG File, 301 Devices Strong, Leaked 7,167 Credentials

TOR_LOG MIX 301PCS: 7,167 Credentials Pulled From Infected Devices

In July 2024, HEROIC analysts identified a stealer log file named "TOR_LOG MIX 301PCS" shared with a Telegram audience. The "301PCS" label points to 301 separate infected devices that fed into the file, together producing 7,167 records that pair email addresses and plaintext passwords with the URLs where each login was captured.

Why This Is Dangerous

Because this data was pulled directly from malware running on the victims' own devices, it reflects logins that were active and working at the time of infection rather than old, possibly-changed credentials from a past breach. With the passwords stored in plaintext and matched to the exact URL used, an attacker can go straight from opening the file to attempting a login, no extra work required.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs

Why This Matters

Because the file references Tor, the software many people use to browse anonymously, some of the accounts in this batch may belong to users who assumed their activity could not be traced back to them. Regardless of intent, everyone in the file faces the same exposure: credential stuffing against other accounts, direct account takeover, and identity theft if enough personal detail can be pieced together from the exposed logins.

How Stealer Logs Work

Infostealer malware infects a device, often bundled with pirated software, cracked tools, or a malicious download, and then quietly harvests saved passwords, browser session data, and autofill details before sending everything back to the attacker in a text file. Sellers often combine output from many infected devices into a single "mix" file, as with this 301-device batch, labeling it by size before offering it up on Telegram or dark web forums.

Check If You Are Affected

If you want to know whether your information turned up in this leak, HEROIC's free breach scanner checks your email address against more than 400 billion leaked records, including stealer logs like this one. It takes only a moment to search, and finding out now means you can secure any exposed account before someone else gets to it first.