TOR_LOG MIX 221log: 4,195 US Stealer Log Credentials Exposed Oct 4, 2023

TOR_LOG MIX 221log: One of Two Oct 4 Batches From the Same Operator

TOR_LOG MIX 221log is the first of two confirmed TOR_LOG MIX batches released on October 4, 2023. A second batch -- TOR_LOG MIX 235logs, containing 4,035 records from 235 source files -- was released the same day. Together the two batches represent 456 source files and 8,230 US credentials released by a single operator within a 24-hour window, two days before the Oct 6 single-day credential cluster. The naming convention -- "TOR_LOG MIX" -- suggests a mix of log sources rather than a single campaign, with each batch's file count encoded in the suffix for analyst identifcation.

TOR_LOG MIX 221log (October 2023): Stealer Log Summary

• Records Exposed: 4,195
• Data Types: Email addresses, plaintext passwords, URLs
• Breach Type: Stealer log -- credentials harvested from malware-infected endpoints, not a direct database breach
• Password Type: Plaintext -- captured directly from browser sessions and credential stores by infostealer malware
• Country: United States
• Date Leaked: October 4, 2023

Per-File Yield: TOR_LOG MIX vs. Comparable Operators

TOR_LOG MIX 221log's 4,195 records across 221 source files yield approximately 19 records per infected endpoint. This is notably higher than many operators in this dataset, where yields of 11-13 records/file are common. A higher yield suggests either the malware was more deeply integrated on each infected machine -- accessing a broader range of stored credentials -- or the log compilation selected for higher-value endpoints rather than accumulating all available captures indiscriminately. The second Oct 4 batch (235logs) produced a slightly lower yield of about 17.2 records/file, consistant with variation across different endpoint populations harvested in the same campaign window.

The "MIX" Designation: Aggregated Sources in Stealer Log Markets

The "MIX" label in TOR_LOG MIX indicates the batch was assembled from multiple distinct source campaigns or malware deployments, rather than representing the output of a single coordinated infection campaign. This aggregation model is common in the Telegram infostealer market: operators purchase or acquire credential batches from multiple smaller sources, compile them into unified log files, and distribute the aggregated product under their own channel brand. This practice makes attribution more difficult and the per-file yield metric less predictive of any single underlying malware strain's efficiency.

Oct 4, 2023: An Active Pre-Peak Date Confirmed Across Multiple Operators

TOR_LOG MIX 221log joins MIRAGE CLOUD, SMOKERCLOUD, and Monster Cloud Free 1 as confirmed Oct 4 operators in this dataset. Collectively, Oct 4 now accounts for tens of thousands of exposed US credentials, establishing the day as a substantail activity window in the multi-day distribution event culminating in the Oct 6 peak. Whether the Oct 4 operators are independently operating or share upstream data sources with the Oct 6 contributors remains an open question in ongoing dataset analysis.

Check If Your Data Was Exposed

HEROIC's free breach scanner covers more than 400 billion exposed records, including stealer log releases like TOR_LOG MIX 221log. If your email or credentials appear in this batch, HEROIC will surface the match instantly -- and you can take action to secure your accounts before attackers exploit the exposure. Search free at HEROIC's breach scanner.