American Users Targeted by ‘USA Only’ Stealer Log: 26,511 Records

The 'USA Only' Stealer Log Targets American Accounts

On August 2, 2026, HEROIC analysts identified a stealer log labeled USA Only uploaded to Telegram, exposing 26,511 records specifically curated to include only credentials tied to United States users. Each record contained an email address, a plaintext password, and the URL where the login was captured.

Why This Is Dangerous

Filtering a stealer log down to a single country makes it more attractive to buyers who want to target a specific region, such as scammers running fraud schemes aimed at American banks, retailers, or government services. Because the passwords are stored in plaintext, an attacker can log into any of these 26,511 accounts immediately, without needing to crack or guess anything.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs tied to each login

Why This Matters

When a stealer log is filtered by country, it usually means the attacker plans to run more targeted attacks, such as credential stuffing against American financial institutions or phishing campaigns tailored to U.S. based services. Anyone whose credentials are in this file faces a real risk of account takeover, identity theft, and financial fraud, particularly if they reused the same password on other sites.

How Country Specific Stealer Logs Are Created

Stealer log malware infects devices and silently harvests saved passwords, autofill data, and login sessions regardless of where the victim lives. Criminals then sort these massive collections by location, often using IP address or language data, to create smaller, targeted files like USA Only. These curated logs sell for a premium on Telegram and dark web markets because buyers know exactly who they are targeting.

Check If You Are Affected

If you are based in the United States, this is exactly the kind of leak worth checking against. HEROIC's free breach scanner searches more than 400 billion leaked records, including country specific stealer logs like USA Only, so you can confirm your exposure and secure your accounts right away.