Analysts Link Universe_Logs 5600 Part 2 to 104,098 Stolen Logins

In October 2025, HEROIC analysts identified the second installment of a stealer log series named Universe_Logs 5600 Cloud Logs.part2, uploaded to a Telegram channel by an unverified user. This part contained 104,098 records, each linking a victim's email address to a plaintext password and the URL of the login page it belonged to, adding to the more than 200,000 combined records HEROIC has tracked across both parts of this series.

Why a Second Batch From the Same Source Is Still Dangerous

Splitting a stealer log into multiple parts does not make any single part less serious. Part 2 still gives attackers 104,098 fresh, working email and password pairs, each tied to the exact site it unlocks. Because the passwords come straight from infected devices, they are typically still in active use, making them immediately useful for breaking into real accounts.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the associated login pages

Why This Matters

With another 104,098 credential pairs added to this series, the risk of credential stuffing grows further. Anyone whose email appears in this file and who reused their password elsewhere faces a real chance of account takeover, financial fraud, or identity theft, particularly since large stealer log series like this one tend to circulate widely once the first parts start attracting attention.

How the Universe_Logs 5600 Series Was Built

This series comes from infostealer malware, which spreads through cracked software, fake downloads, and malicious attachments. Once it infects a device, it silently copies saved browser passwords, cookies, and autofill data, then sends everything back to the attacker. Because the total volume of stolen data was too large for one file, the uploader split it into parts, with this record set making up part 2 of the collection.

Check If You Are Affected

With two parts of this series already circulating, checking your exposure is worth doing now. HEROIC's free dark web scanner searches more than 400 billion leaked records, including stealer logs like this one, so you can see in seconds whether your email turned up in the Universe_Logs 5600 dump.