Everlasting_Cloud Passwords Leaked in June, Surfaced in October

Everlasting_Cloud Stealer Log: 17,155 Records Surface Months Later

HEROIC analysts traced a stealer log uploaded to a public Telegram channel back to June 11, 2025, under the name "Everlasting_Cloud." The file contains 17,155 records, each pairing an email address with a plaintext password and the API host URL tied to that credential. Although the underlying theft happened months ago, the dataset is only now surfacing publicly, giving affected users a long window in which their credentials were exposed without their knowledge.

Why This Is Dangerous

A stealer log sitting unnoticed for months is arguably more dangerous than one caught immediately, because it gives attackers extra time to test and exploit the credentials before the people affected have any reason to suspect a problem. With plaintext passwords paired directly to the URLs they unlock, anyone who obtains this log can log in immediately, no cracking required.

What Was Exposed

• Email addresses
• Plaintext passwords
• API host URLs tied to each credential pair

Why This Matters

Every day a stealer log circulates unnoticed is another day attackers can use it for credential stuffing, testing stolen email and password pairs against banking, shopping, and email accounts. Because the passwords here were captured in plaintext, they work immediately, and the delayed discovery of this log means some of the 17,155 people affected may have already had other accounts compromised without realizing why.

How Stealer Logs Work

A stealer log is produced by infostealer malware that infects a device, often through a pirated download or phishing link, then quietly copies saved browser credentials, autofill data, and login sessions. The malware sends this information back to whoever controls it, and from there it is often shared or sold on Telegram channels, exactly where this dataset was found, sometimes months after the original infection took place.

Check If You Are Affected

If your email address might be part of the Everlasting_Cloud stealer log or any other breach, HEROIC's free breach scanner checks it against a database of more than 400 billion exposed records. Run a scan now, and if your information turns up, change the affected password immediately along with anywhere else you may have reused it.