HEROIC Analysts Uncover USA MOON Leak Exposing 18 Accounts

USA MOON Stealer Log: 18 Records Exposed on May 29, 2026

HEROIC analysts uncovered a small stealer log dataset labeled "USA MOON" circulating on Telegram, dated May 29, 2026. The file is modest in size, just 18 records, but each one contains a complete set of stolen login data: an email address, a plaintext password, and the URL of the site that password unlocks.

Why the USA MOON Leak Is Dangerous

Small does not mean harmless. With only 18 records, the value to a criminal isn't scale, it's precision. Each entry is a ready-to-use login, no cracking required, since the password sits in plaintext and is already paired with its exact URL. For the 18 people involved, that means someone could try logging into their real accounts today.

What Was Exposed

• Email addresses
• Plaintext passwords, stored in readable form
• URLs of the login pages tied to each stolen credential

Why This Matters

Because each of these 18 credential pairs is already matched to a working login page, the immediate risk is account takeover. If any of these individuals reused that same password on another account, email, banking, or shopping, an attacker could pivot from this one small file into a broader case of identity theft or financial fraud.

How Stealer Logs Work

HEROIC's researchers traced this file back to infostealer malware, families such as RedLine, Raccoon, or Vidar, that infects a device through a cracked download, malicious ad, or phishing link, then quietly copies whatever is saved in the browser: usernames, passwords, cookies, and autofill data. That stolen data is packaged into a "log" and shared or sold on Telegram channels, which is exactly where HEROIC's analysts found this batch.

Check If You Are Affected

Even a small leak like this one is worth checking. HEROIC's free breach scanner searches your email against more than 400 billion leaked records gathered from breaches, stealer logs, and dark web dumps, and tells you in seconds if your information has surfaced.