Act Now: Redline_Cl0ud4 Stealer Log Leaks 112,083 Fresh Logins

A Telegram channel known for distributing stolen login data pushed out a new file on 19-May-2026, and this one wasn't small. The Redline_Cl0ud4 stealer log, labeled "Fresh ULPP", handed over 112,083 records in one drop, each one a full set of email, password and the site it was stolen from. HEROIC's monitoring team flagged it as soon as it surfaced.

Why This Is Dangerous

At over one hundred thousand records, this leak gives criminals a huge, ready to use list of working logins. Unlike a hashed password database that needs to be cracked before it's useful, this data is already in plaintext, meaning it can be tested against real accounts imediately, with no extra work needed on the attacker's side.

What Was Exposed

• 112,083 total exposed records
• Email Addresses
• Plaintext Password
• URLs

Why This Matters

A file this size is definately big enough to attract multiple buyers on Telegram and dark web forums, not just one. That means the same 112,083 credentials could end up being tested by several seperate criminal groups, each running their own automated login attempts against banks, streaming services and email providers.

How Stealer Log Works

Stealer malware sits quietly on an infected device and copies whatever is saved in the browser, including stored passwords, autofill fields and active session cookies. Every so often it bundles up what it collected and uploads the file to the person running the operation, who then repackages and resells it, often through Telegram groups just like the one this file came from.

Check If You Are Affected

With more than 400 billion breached records in its database, HEROIC's free scanner can tell you in moments if your email address turns up in this leak or any other one. It only takes checking your email to find out, and it's free.