US Users Hit as GHOST FREE 4 Leak Exposes 311,832 Logins

A second wave of the "GHOST FREE 4" series hit Telegram on 17-Oct-2025, and this release dwarfs the earlier one HEROIC tracked days before. This time the file carried 311,832 records, with HEROIC's monitoring tagging the bulk of the exposure to United States based accounts, meaning American consumers make up a large share of the people affected.

Why This Is Dangerous

When a leak concentrates heavily on one country, it tends to attract attackers who specialize in that region, people who already know wich banks, retailers, and mail providers are popular there and can target them more efficiently. A file weighted toward United States accounts like this one gives criminals a ready-made list to test against the exact services millions of Americans use every day.

What Was Exposed

• 311,832 total records exposed
• Email Addresses
• Plaintext Password
• URLs showing which site each login belongs to

Why This Matters

If you are based in the United States, leaks like this deserve a bit more of your attention, simply because the odds of a domestic service being targeted next go up. Alot of everyday accounts, from email to online banking to retail loyalty programs, are exactly the kind of thing criminals look for once they have a large batch of country specific logins in hand. It's not that people outside the US are safe, it's that this particular file skews heavily toward American victims.

How a Country Specific Leak Comes Together

Infostealer malware doesn't usually target a country on purpose, it simply infects whatever device it reaches through a phishing email, cracked download, or malicious ad. What can happen afterward, though, is that whoever collects the stolen data sorts it by the language, currency, or location signals found in the browser, then packages the United States focused records seperately from everything else to sell or share as a themed batch like this one.

Check If You Are Affected

Whether you are in the United States or anywhere else, it only takes a minute to check. HEROIC's free breach scanner searches more than 400 billion exposed records worldwide, so you can confirm right away if your email shows up in GHOST FREE 4 or any other leak and take action before your login gets used.