Check If Your iCloud Login Is in This 746-Record Stealer Leak

On July 13, 2026, a Telegram user uploaded a stealer log file containing 746 sets of login credentials for icloud.com. The file included email addresses, plaintext passwords, and the URLs of the accounts they unlock, all pulled from individual devices infected with credential-stealing malware, not from Apple's own servers.

This Is a Stealer Log, Not an Apple or iCloud Breach

Apple was not hacked and iCloud's infrastructure was not compromised. What actually happened is that infostealer malware infected 746 individual users' devices and copied the iCloud usernames and passwords those people had saved in their browsers. The exposure lives on the victims' machines, not inside Apple's systems, but the danger to those 746 accounts is exactly the same as if it had come from Apple directly.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the iCloud accounts and related services

Why This Matters

An iCloud account often unlocks far more than email. It can be tied to photos, device backups, Find My iPhone, and Apple Pay, which makes these 746 accounts a high-value target. Since the passwords were leaked in plaintext, anyone with the file can log straight in. If any of these users reused their iCloud password on other sites, attackers can also use credential stuffing to break into those accounts too, leading to identity theft and financial fraud.

How This iCloud Stealer Log Was Built

Infostealer malware typically spreads through fake downloads, cracked software, or phishing attachments. Once installed on a device, it quietly copies every saved password and login session from the browser, then sorts the stolen data by the site it belongs to, in this case icloud.com. The resulting list is uploaded to Telegram, where it can be downloaded for free or sold to other criminals looking for working Apple account logins.

Check If You Are Affected

If you use an iCloud account, or you reuse the same password across multiple sites, it is worth checking whether your details are part of this or another leak. HEROIC's free breach scanner searches a database of more than 400 billion leaked records, including stealer logs like this one, and tells you instantly if your information has been exposed. Run a free scan now and secure your iCloud account before someone else logs in first.