Act Now: SunCloudNew ULP Leak Exposes 86,005 Stolen Logins

There is no gentle way to say this, a file called SunCloudNew 1322 - 433 K ULP is circulating right now with 86,005 confirmed stolen logins inside it, and every day that passes without checking your exposure is a day an attacker could get there first.

Why This Is Dangerous

This is not a theoretical risk sitting in some old archive, it is an active stealer log with plaintext passwords ready to use immediatly. Whoever downloads this file does not need to decode or crack a single thing, they can start testing logins the moment they open it, wich is exactly why speed matters here.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs tied to each stolen login
• 86,005 records total

Why This Matters

Every one of these 86,005 logins was working at the time it was collected. If yours is among them and you have not changed that password since October 2025, you are running on borrowed time. Reused passwords make the situation worse, turning one exposed login into a key for several accounts at once.

How Stealer Logs Work

The mechanism here follows the usual pattern, infostealer malware lands on a device through a fake download or malicious link, then reads the browser's saved passwords and packages them into a numbered ULP file like this one, named SunCloudNew for the campaign behind it. It gets released, and from that point forward the clock is running for anyone whose credentials are inside.

Check If You Are Affected

Do not put this off. HEROIC's free breach scanner checks your email against more than 400 billion leaked records right now, including this SunCloudNew release, so you can find out in seconds and change any exposed password before someone else uses it.