82K Records: MetaCloudVipNew Stealer Leak (Oct 2025)

On October 19, 2025, the MetaCloudVipNew stealer malware campaign released 82,284 compromised credential records through Telegram. The 361K designation in the filename suggests this dump represents only a portion of a much larger harvested database. The dataset includes email addresses, plaintext passwords, system endpoint information, and authentication URLs extracted from Windows machines infected with stealer malware. This release follows the same pattern as other mass credential distribution campaigns.

What This Breach Signals
MetaCloudVipNew's release of 82,000 records indicates an ongoing, large-scale malware harvesting operation with thousands of active infection vectors. The attacker is clearly accumulating credentials faster than they can sell them, leading to public releases to build reputation and attract bulk buyers. The October 19 release timing suggests this operator is actively monetizing victim data in real time.

What Was Exposed

• 82,284 email addresses across providers
• Plaintext passwords with no encryption
• System endpoint and device identifiers
• API authentication URLs and tokens
• Browser session cookies and cached data

Why This Matters

MetaCloudVipNew breaches are dangerouse because the attacker is operating openly and reliably. Unlike one-time leaks from individual hackers, this represents an established criminal operation with infrastructure, distribution channels, and proven monetization. The 361K file designation suggests the attacker has segmented their database into marketing samples. This breach is likely one of dozens already released with many more in the pipeline. If your credentials appear here, they're already in circulation among multiple criminal groups.

How MetaCloudVipNew Distributes Malware

MetaCloudVipNew is packaged and distributed through an affiliate network. The malware is deployed via phishing campaigns, malicious ads, and fake software distribution sites. Once installed on a system, it creates a hidden service that continuously harvests credentials, browser data, and system information. The collected data is automatically uploaded to attacker-controlled servers where it's processed and sorted by target profile for optimal resale pricing.

Check If You're Affected

Search your email address in the databases below. If found, your account requires immediate password reset and security audit.