The Cloud_Rolex_2 Stealer Log Put 6,899 Plaintext Passwords Online

Cloud_Rolex_2: A Stealer Log Exposing 6,899 Accounts

HEROIC analysts identified a stealer log file labeled "Cloud_Rolex_2" uploaded to a public Telegram channel on August 13, 2025. The file contained 6,899 records, including email addresses, plaintext passwords, and the URLs of the login portals or API endpoints tied to each account. Most of the exposed records trace back to users in the United States.

Why This Is Dangerous

The passwords in this file were stored in plaintext, meaning anyone who downloads the log can log straight into an account without cracking or guessing anything. Pairing plaintext passwords with the URL of the service each one belongs to removes the guesswork attackers normally face, turning a list of stolen credentials into a ready made attack script.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs

Why This Matters

Even a leak of under 7,000 records is enough to fuel credential stuffing attacks, where automated tools test stolen email and password pairs against dozens of other websites at once. Anyone who reused one of these 6,899 passwords elsewhere is exposed to account takeover, and from there to financial fraud or identity theft if the compromised account holds payment details or personal information.

How a Stealer Log Like This Gets Created

A stealer log is generated by infostealer malware that infects a device, often through a pirated download or a malicious attachment, and silently copies saved browser passwords, cookies, and autofill data. The malware packages everything it finds into a single file, which is then uploaded to Telegram channels or dark web forums under names like Cloud_Rolex_2, where anyone can download it for free and begin testing the credentials inside.

Check If You Are Affected

There is no way to tell just by looking whether your email address is part of a stealer log like this one. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including logs like Cloud_Rolex_2, and tells you right away if your credentials have been exposed. Run a scan now and update any password that comes back compromised.