Over 890,000 credential pairs extracted from RedLine and Lumma stealer logs targeting healthcare worker portals were published on Russian-language breach forum BreachForums.