30,880 Plaintext Passwords From the WALLETS New Telegram Leak Just Surfaced

HEROIC analysts identified a stealer log file uploaded to a public Telegram channel on October 30, 2023, labeled "WALLETS New." The file contained 30,880 records pulled directly from compromised endpoints, exposing email addresses, plaintext passwords, and the URLs of services the victims had been accessing. Unlike a traditional database breach, this data was not stolen from a company's servers. It was harvested directly from infected computers using malware designed to silently capture everything a user types or saves in their browser.

Why the WALLETS New Leak Is More Dangerous Than It Looks

When passwords are exposed in plaintext, there is no cracking required. Whoever downloads this file gets working credentials they can use immediately. With 30,880 email and password pairs in hand, an attacker can attempt to log into banking apps, email accounts, and social media within minutes. Because most people reuse passwords across multiple sites, even one match can open the door to several accounts at once. The presence of URLs in the data tells attackers exactly which services the victims used, making targeted attacks far more efficient.

What Was Exposed in the WALLETS New Data Leak

• Email addresses tied to real user accounts
• Plaintext passwords captured directly from infected devices
• URLs showing which websites and services the victims accessed
• Endpoint data indicating the devices and sessions where credentials were stored

Why This Matters for People Whose Data Was Exposed

Credential stuffing is one of the most common attack methods today. Criminals take leaked email and password combinations and run them against dozens of popular websites automatically. If your password from one service matches another, your account gets compromised without you ever recieving a warning. Beyond account takeovers, exposed email addresses invite phishing attacks and spam campaigns. For users whose financial or banking credentials were captured, the risk of direct financial fraud is significant and immediate.

How Stealer Log Malware Works

A stealer log is the output of infostealer malware. This type of malware quietly installs itself on a computer, often through a malicious download, a fake software update, or a phishing link. Once installed, it runs in the background and records everything: passwords saved in browsers, login sessions, cookies, and the URLs of sites you visit. All of that data gets bundled into a log file and sent back to the attacker. The attacker then sells or shares those log files, often through Telegram channels, where other criminals can download them freely. The name "WALLETS New" suggests this particular batch may have been focused on capturing credentials related to financial or cryptocurrency accounts.

Check If Your Data Appears in the WALLETS New Leak

HEROIC's free breach scanner checks your email against a database of over 400 billion compromised records, including stealer log dumps like this one. If your credentials appeard in the WALLETS New file or any related leak, you will recieve an instant alert so you can change your passwords before an attacker gets there first. Search your email now at HEROIC to find out if you are at risk.