99,858 Passwords From the UHQ Mix Part 6 Stealer Log Just Surfaced

In March 2023, HEROIC analysts identified a stealer log labeled "UHQ Mix Part 6" circulating on a Telegram channel. UHQ stands for "ultra high quality," a term cybercriminals use to market credential lists they consider especially clean and reliable. This particular file contained 99,858 records pulled from infected devices, including email addresses, plaintext passwords, and the URLs each login was tied to.

Why This Is Dangerous

The "ultra high quality" label matters because it signals that the credentials in this file have likely already been checked and confirmed to work, making them more dangerous than an unverified list of the same size. Each of the 99,858 records pairs a specific email address with its plaintext password and the exact site it unlocks, so an attacker can log in directly without any guesswork. With nearly 100,000 working logins in one file, this is the kind of data that gets bought, sold, and reused across multiple criminal operations.

What Was Exposed

This leak included the following data types:

• Email addresses
• Plaintext passwords
• URLs linked to each set of credentials

Why This Matters

A verified list of this size is prime material for credential stuffing, where attackers run stolen email and password pairs against banking, email, and social media logins in bulk. Because so many people reuse passwords across different accounts, a single exposed credential from this file can lead to account takeover on services that have nothing to do with the original infection. The "ultra high quality" branding also means this list may circulate widely and get repackaged into other combolists over time, extending the exposure well past the initial leak.

How Stealer Logs Work

A stealer log is the product of information-stealing malware, malicious software that infects a device through cracked programs, fake downloads, or malicious attachments. Once installed, it collects saved browser passwords, autofill data, and active sessions, then compiles everything into a file. What sets a "UHQ" mix apart is that sellers often filter and verify these logs before distribution, removing dead accounts and duplicates so buyers get a higher rate of working credentials, which is exactly why lists like this one are treated as premium goods on Telegram and dark web marketplaces.

Check If You Are Affected

With 99,858 records in this verified stealer log, there is a real chance your email address is part of it. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including stealer logs like this one, so you can find out quickly and change any reused passwords before someone else takes advantage of them.