Inside the US 170 LOGS Stealer Log: How Malware Took 1,862 Passwords

In June 2024, HEROIC analysts identified a stealer log named "US 170 LOGS" uploaded to Telegram. The file contained 1,862 records made up of email addresses, plaintext passwords, and the URLs where each credential was used.

Why This Is Dangerous

This file was generated by malware that ran on infected devices and recorded login details as people entered or saved them in their browser. Because the passwords sit in plaintext and are matched to the exact site each one belongs to, anyone who downloads the file can start logging into accounts immediately.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs

Why This Matters

Even a file with under 2,000 records can cause real harm to the people in it. If your email and password show up here, an attacker already has a working login and knows exactly which site to use it on. That is enough to take over an account, and if the account connects to financial or personal information, it can lead to fraud or identity theft.

How This Stealer Log Was Created

A stealer log like "US 170 LOGS" comes from information-stealing malware that infects a device, often through a fake download, cracked software, or a malicious email attachment. Once active, it quietly collects saved passwords, cookies, and autofill data from the browser, then sends everything back to whoever controls the malware. Files like this often circulate afterward on Telegram, exactly how this one was found.

Check If You Are Affected

You do not have to guess whether your credentials are part of this stealer log. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including this one, so you can find out in seconds. If you find a match, change that password immediately and update it anywhere else you have reused it.