Our Analysts Found the ‘USA Only’ Stealer Log on Telegram

HEROIC analysts discovered a stealer log named USA Only circulating in a Telegram channel on July 26, 2026. The file is labeled as US-targeted, though that claim comes from whoever uploaded it rather than independent verification, and it contains 9,316 records pulled from infected devices, including endpoints, email addresses, API hosts, and passwords. Why This Is Dangerous: Unlike a combolist assembled from old leaks, a stealer log comes directly from malware that ran on someone's device and captured what was actually stored in their browser at that moment. That means the passwords in USA Only were, at some point, real and in active use, which makes them more likely to still work than data recycled from years-old breaches. What Was Exposed: - Email addresses - Plaintext passwords - Endpoints and API hosts tied to each login Why This Matters: Stealer log data feeds directly into account takeover attempts because it reflects credentials people were actively using, not ones they may have already changed. If your login shows up in a file like this, an attacker doesn't need to guess or crack anything, they already have a working password to try against your accounts. How a Stealer Log Like This Works: Infostealer malware infects a device, often through a fake download or cracked software, then quietly copies saved browser passwords, autofill data, and session details before sending everything back to whoever controls the malware. The result gets packaged into a log file like USA Only and sold or shared on Telegram, often within days of the infection. Check If You Are Affected: If your device has ever downloaded software from an untrusted source, it's worth checking. HEROIC's free breach scanner checks your email against more than 400 billion leaked records, including stealer logs like this one, so you can find out quickly and change any exposed passwords.