Search Your Email: The Wallets3 Dump Exposed 7,541 Accounts

Stealer Log "Wallets3" Exposes 7,541 Records

HEROIC analysts identified a stealer log file uploaded to a public Telegram channel on December 16, 2022, containing 7,541 records tied to United States accounts. The log, labeled "Wallets3," exposed email addresses, plaintext passwords, and API host URLs harvested directly from infected devices.

Why This Is Dangerous

Because the passwords in this log were captured and stored in plaintext, anyone who obtains the file can log directly into the affected accounts without cracking or decrypting anything. The URLs recorded alongside each password reveal exactly which service each login unlocks, making it simple for an attacker to move from one compromised account to the next.

What Was Exposed

• Email addresses
• Plaintext passwords
• API host URLs (the services each login connects to)

Why This Matters

With 7,541 sets of credentials exposed in plaintext, this log gives attackers a ready-made list for credential stuffing, testing each stolen email and password combination against banking sites, email providers, and other services. Anyone in this group who reused a password elsewhere faces real risk of account takeover, identity theft, and financial fraud.

How Stealer Logs Work

A stealer log is generated by information-stealing malware that infects a device, often through a malicious download, cracked software, or a phishing link, and silently harvests saved passwords, browser data, and visited URLs. That stolen information is sent back to whoever controls the infection, then packaged into a log file and shared, in this case uploaded to a public Telegram channel where anyone can access it. Because the theft happens directly on the victim's device, it bypasses the security defenses of the websites and services themselves.

Check If You Are Affected

Search your email address using HEROIC's free breach scanner to see whether it appears in this stealer log or any of the thousands of similar breaches in HEROIC's database of more than 400 billion leaked records. It takes only seconds, and it lets you change any reused passwords before someone else uses them first.