U.S. Users Targeted: Mansory 5 Exposes 72,634 Passwords

HEROIC identified a stealer log collection known as Mansory 5, shared on Telegram in December 2025, containing 72,634 compromised user records. The data was harvested from infected devices primarily located in the United States, where infostealer malware silently captured credentials as victims logged into websites and online services.

The Danger of Plaintext Passwords in the Wild

Every password in the Mansory 5 leak is stored in plaintext — completely unencrypted and readable by anyone who downloads the file. There is no hashing or encoding to slow down attackers. This means your exact login credentials can be used immediately, without any technical skill required to exploit them.

What Was Exposed

• Email Addresses — personal and professional accounts that serve as usernames across many platforms
• Plaintext Passwords — exact passwords captured in real time by malware on infected machines
• URLs — the login pages and services where each credential was entered

Password Reuse Makes Every Account Vulnerable

When attackers obtain a working email-and-password pair, they immediately test it against dozens of other services through credential stuffing. Because many people use identical passwords for banking, email, social media, and shopping, a single compromised entry from the Mansory 5 dump can cascade into a full account takeover across multiple platforms.

What Are Stealer Logs and How Do They Work

Stealer logs originate from infostealer malware — malicious software that infiltrates devices through fake downloads, pirated applications, or deceptive email attachments. Once active, the malware harvests stored browser passwords, active session cookies, and keystrokes. The collected data is packaged into structured log files and distributed through underground marketplaces and Telegram channels, where collections like Mansory 5 are shared freely or sold to other threat actors.

Check If Your Credentials Were Exposed

The Mansory 5 breach data has been loaded into the HEROIC data breach scanner. With more than 400 billion records indexed, HEROIC provides instant results showing whether your email or password appears in this leak or any other known breach. Run a scan now, update any compromised passwords immediately, and activate two-factor authentication to protect your accounts going forward.