The Cloud_Rolex_2 Leak Exposed 13,285 U.S. Accounts and Passwords

A Stealer Log Named "Cloud_Rolex_2" Exposed 13,285 Records

HEROIC analysts identified a stealer log file called "Cloud_Rolex_2" that surfaced on a Telegram channel on September 3, 2025. The file contained 13,285 records taken directly from infected devices, pairing email addresses with plaintext passwords and the URLs of the accounts those credentials belong to.

Why This Is Dangerous

The passwords in this log are unencrypted plaintext, so there is no barrier between having the file and using the credentials. Combined with the matching email address and account URL, an attacker can log in immediately, with no cracking or guessing needed.

What Was Exposed

• Email addresses
• Plaintext passwords
• Account and login URLs

Why This Matters

A large share of the accounts in this leak belong to U.S. users, and because so many people reuse passwords across sites, one exposed plaintext password can open accounts well beyond the one it was stolen from. Attackers commonly use logs like this for credential stuffing, testing the exposed email and password pairs against banking, email, and social media platforms. That chain of reuse is what turns a single leaked password into financial fraud and identity theft.

How Stealer Logs Work

A stealer log is produced by infostealer malware that infects a device and silently copies saved browser passwords, autofill entries, and session data before sending it to the attacker controlling the malware. The stolen data is then packaged into files like "Cloud_Rolex_2" and shared through channels such as Telegram. Because the credentials come directly from the infected device, one log can expose access to many unrelated accounts and services at once.

Check If You Are Affected

HEROIC's free breach scanner checks your email address against a database of more than 400 billion leaked records, including stealer logs like this one. Run a free scan to see if your credentials were exposed and get guidance on securing your accounts.