Researchers Link ‘TOR_LOG MIX’ Stealer Logs to 7,384 Stolen Credentials

HEROIC analysts identified a stealer log dump labeled "TOR_LOG MIX 299PCS," posted to Telegram on 15-Jun-2024. The file contains 7,384 records pulled from infected devices, including email addresses, plaintext passwords, and the URLs and API endpoints those credentials were captured from.

Why This Is Dangerous

Unlike a combolist built from old breach data, a stealer log comes directly from malware that ran on someone's device and copied whatever credentials were saved in their browser at that moment. That means the passwords in this file are recent and were, at the time of infection, actively in use, which makes them far more likely to still work than credentials recycled from years-old breaches.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated URLs and API endpoints

Why This Matters

With 7,384 freshly harvested credentials in hand, attackers can attempt account takeover across whatever services each infected device's owner was logged into, from email to banking to shopping accounts. Because stealer logs often capture multiple saved logins from a single device, one infection can expose several accounts belonging to the same person, opening the door to credential stuffing on other sites, financial fraud, and identity theft.

How Stealer Logs Like This One Are Created

Stealer log malware infects a device, often through a fake download, cracked software, or malicious attachment, and then quietly scans the browser for saved usernames, passwords, and session data before sending everything back to the attacker. The "MIX" in this file's name suggests logs from multiple infected devices were combined into a single dump of 299 pieces before being shared on Telegram, a common practice among sellers looking to bundle and resell stolen data.

Check If You Are Affected

Because stealer log credentials tend to be current, it is worth checking right away whether your email address appears in this dump or in any other breach HEROIC tracks. HEROIC's free breach scanner searches a database of more than 400 billion exposed records in seconds. If your information turns up, change your passwords immediately and run a malware scan on your device.