The Cloud_Rolex_2 Stealer Log Quietly Exposed 17,440 Passwords

The Cloud_Rolex_2 Stealer Log Quietly Surfaced on Telegram

HEROIC analysts identified a stealer log uploaded to a public Telegram channel on September 27, 2025. Labeled Cloud_Rolex_2, the file exposed 17,440 records tied to United States based accounts, combining email addresses, plaintext passwords, and the URLs each credential is tied to. No headlines announced it. It simply appeared, sitting quietly among other files in the channel.

Why This Is Dangerous

A quiet leak is not a small one. These passwords were captured in plaintext directly from infected devices, so there is no encryption for an attacker to break. Each email address is already matched to its real password and the exact site it opens, meaning anyone who happens to find this file can begin logging into accounts immediately.

What Was Exposed in the Cloud_Rolex_2 Log

• Email addresses
• Plaintext passwords
• URLs tied to each set of credentials

Why This Matters

Because these plaintext passwords are already matched to the sites they unlock, they are directly usable for credential stuffing, where stolen logins are tested automatically across banks, email providers, and shopping sites. Anyone among the 17,440 exposed accounts who reused a password elsewhere faces real risk of account takeover, identity theft, and financial fraud, whether or not this leak ever makes headlines.

How Stealer Log Breaches Work

A stealer log is produced by infostealer malware that infects a device through a malicious download, cracked software, or a phishing link. Once installed, it reads saved usernames, passwords, and the web addresses tied to them straight from the browser, then bundles it all into a single file. That file is then uploaded to Telegram channels like this one, often without drawing any public attention at all.

Check If You Are Affected

Quiet leaks are still real leaks. Find out whether your email address is one of the 17,440 exposed in the Cloud_Rolex_2 dump, or in any other breach, with HEROIC's free scanner. It checks your information against a database of more than 400 billion leaked records.