12,312 US Accounts Hit in the Cloud_Rolex Stealer Log Leak

A Stealer Log Named "Cloud_Rolex" Exposed 12,312 Records

HEROIC analysts identified a stealer log file called "Cloud_Rolex" that was uploaded to a Telegram channel on September 5, 2025. The file contained 12,312 records taken directly from infected devices, pairing email addresses with plaintext passwords and the URLs of the accounts those credentials belong to.

Why This Is Dangerous

Every password in this log is stored in plaintext, so an attacker can use it the moment they get the file, with no cracking required. Matched with the correct email address and the URL of the account it unlocks, this data is ready to use for immediate account access.

What Was Exposed

• Email addresses
• Plaintext passwords
• Account and login URLs

Why This Matters

The 12,312 accounts in this leak are ordinary consumer accounts, exactly the kind of accounts where password reuse is most common. If someone in this log used the same password on their email, banking, or social media account, that account is now exposed too. Attackers rely on this kind of reuse for credential stuffing, which can quickly turn into account takeover, financial fraud, and identity theft.

How Stealer Logs Work

Stealer logs come from infostealer malware, software that quietly infects a device and copies saved browser passwords, autofill data, and session details before sending them to the attacker running it. The results are then bundled into files like "Cloud_Rolex" and distributed through channels such as Telegram. Because the malware pulls credentials straight from the device, a single log can expose access to many unrelated accounts and services at once.

Check If You Are Affected

HEROIC's free breach scanner checks your email address against a database of more than 400 billion leaked records, including stealer logs like this one. Run a free scan to find out if your credentials were part of this leak and learn how to secure your accounts.