UHQ Streaming Leak Means 166,233 Accounts Are Ready to Steal

HEROIC detected a high-value stealer log collection labeled 172k UHQ Streaming base being freely distributed on Telegram. First circulating in February 2023, this dataset targets streaming service accounts and contains 166,233 records with email addresses, plaintext passwords, and the specific streaming platform URLs where these credentials were entered.

Plaintext Streaming Passwords Are Instantly Exploitable

All 166,233 passwords in this dump are stored in plaintext—completely unencrypted and readable at a glance. Streaming account credentials are particularly sought after by cybercriminals because they can be resold on underground markets or used to access premium content without payment. Since these passwords require no cracking whatsoever, stolen streaming accounts from this dump can be listed for sale within minutes of the file being downloaded.

What Was Exposed

• Email Addresses — accounts registered with streaming platforms and related services
• Plaintext Passwords — fully visible, unprotected credentials
• URLs — streaming service login pages and associated platforms where credentials were harvested

Streaming Credentials Open the Door to Far More

While losing access to a streaming account may seem minor, the real danger lies in password reuse. Attackers routinely test streaming service credentials against email providers, online banking, e-commerce platforms, and cloud storage services. With 166,233 email-password pairs, automated credential stuffing attacks can compromise far more valuable accounts. A Netflix or Spotify password that matches your Gmail or PayPal login turns an entertainment account breach into a financial security crisis.

How Stealer Malware Targets Streaming Users

This data was collected by infostealer malware—often spread through fake streaming apps, pirated content downloads, or "free premium account" scams that specifically target entertainment seekers. Once installed, malware like RedLine, Vidar, or Aurora harvests browser-saved passwords, session tokens, and form data from the infected device. The logs are then organized by category—streaming, banking, social media—and distributed through Telegram channels catering to specific buyer interests.

Check If Your Credentials Were Exposed

With over 400 billion records in its breach intelligence database, HEROIC provides comprehensive coverage of stealer log leaks, data breaches, and dark web exposures. Use HEROIC's free breach scanner to check if your email appears in the 172k UHQ Streaming base dump or any other compromised dataset. If your credentials are found, change your streaming passwords immediately, ensure they are unique to each service, and enable two-factor authentication on every account that supports it.