Researchers Uncover Zelenkalink 153 Leak of 10,542 Logins

It surfaced almost by accident: a routine sweep of Telegram channels turned up a file called zelenkalink 153- ScroogeUrl, uploaded May 30, 2026, holding 10,542 stolen login records that had gone unnoticed for a short while.

Why This Is Dangerous

The gap between when a file like this gets uploaded and when anyone outside the channel notices it can matter a lot. During that window, the data is being freely downloaded by anyone who stumbles across the channel, tested against real accounts, before the average person affected ever hears a thing.

What Was Exposed

• Email addresses pulled from infected devices
• Passwords sitting in fully readable plaintext
• URLs indicating which site each login belonged to

Why This Matters

Discovering a leak after the fact doesn't undo any damage that's already occured, it just means you can start reacting instead of staying in the dark. With a numbered name like "153," this file suggests it's just one entry in a much larger series that's been building quietly for a wile.

How Stealer Logs Work

Files like this typically get discovered because researchers and automated tools continuously moniter known Telegram channels for exactly this kind of upload. Behind the scenes, the process that created it is straightforward: malware harvests saved browser credentials from an infected machine, and the operator compiles those records into a numbered log before releasing it into the same channels being watched.

Check If You Are Affected

You don't have to wait for a researcher to stumble onto your data before you find out. HEROIC's free scanner checks your email directly against more than 400 billion leaked records, including this zelenkalink batch, so you can make the discovery yourself, on your own schedule.