84,927 Passwords Exposed in MetaCloudVipNew Data Breach

On October 31, 2025, HEROIC analysts detected a new stealer log circulating on Telegram under the name "MetaCloudVipNew." The file contained 84,927 records, each combining an email address, a plaintext password, and the URL of the site the credentials were used on. Like most stealer logs, the data was not stolen from a company's servers. It was harvested directly from victims' own devices by malware that had been running in the background, undetected.

Why This Is Dangerous

The danger here comes from how usable this data already is. Because the password sits in plaintext next to the exact website it unlocks, an attacker doesn't have to do any extra work. They can load the record and try logging in immediately, whether that's an email inbox, a shopping account, or a work login.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the linked accounts

Why This Matters

Stolen credentials like these rarely stay isolated. They get merged into massive credential-stuffing lists used to test logins across dozens of unrelated sites, since so many people reuse the same password everywhere. When a match hits, it usually means account takeover, which can quickly escalate into identity theft or financial fraud if a banking, payment, or tax-related account is involved.

How Stealer Logs Work

MetaCloudVipNew, like other stealer logs, traces back to infostealer malware. This type of malware sneaks onto a device thru fake software downloads, cracked programs, or malicious email attachments. Once active, it quietly pulls saved browser passwords and session data, packages them into a file, and sends everything back to whoever controls the malware. That file is then posted or sold on channels like Telegram.

Check If You Are Affected

If you use the same password across multiple sites or save logins in your browser, it's worth checking whether you're part of a leak like this one. HEROIC's free breach scanner searches a database of more than 400 billion leaked records to give you an instant answer, so you can change any exposed passwords right away.