48,489 iCloud Logins Exposed in UHQ Combo Stealer Log, Check Now

In December 2024, HEROIC analysts identified a stealer log listing titled "50000 UHQ icloud.com Lines UHQComboz," uploaded to a Telegram channel by an unidentified user. The file contained 48,489 records tied to iCloud-linked email addresses, including plaintext passwords and the URLs of the login pages where those credentials were captured.

Why This iCloud Stealer Log Is Dangerous

Unlike a breach of a single company's database, a stealer log is built from information taken directly off infected computers. Malware installed on a victim's device quietly copied whatever usernames, passwords, and browser autofill data it could find, then bundled everything into a file for sale or free distribution. Because the passwords in this log were stored in plaintext, anyone who downloads the file can use them immediately, no cracking or decryption required.

What Was Exposed in the 50000 UHQ Combo Log

• Email addresses, primarily linked to iCloud accounts
• Plaintext passwords paired directly with each email
• URLs showing which login pages the credentials were used on

Why This Matters for iCloud Users

Because the email and password pairs in this log are ready to use, they are prime material for credential stuffing attacks, where criminals feed stolen logins into automated tools that test them against dozens of other websites. Anyone who reused their iCloud password on another account, or their other account's password on iCloud, is at risk of account takeover. From there, an attacker could access photos, contacts, backups, and any payment methods tied to the Apple ID.

How Stealer Logs Work

Stealer logs come from a category of malware built specifically to harvest data from an infected device rather than break into a company's servers. Victims are typically tricked into downloading the malware through cracked software, fake game cheats, or malicious email attachments. Once installed, the malware scans browsers and saved credential stores, then quietly sends everything back to the attacker. The resulting file, often labeled with a name like "UHQ" (ultra high quality) or "combo," is then sold or shared on Telegram channels and dark web forums, exactly where HEROIC's analysts found this one.

Check If Your iCloud Email Was Exposed

If you use an iCloud account, or reuse passwords across multiple sites, it is worth checking whether your information has surfaced in a leak like this one. HEROIC's free breach scanner searches a database of more than 400 billion leaked records, including stealer logs like this, to tell you in seconds if your email address has been exposed.