The Cloud_Rolex_2 Stealer Log Quietly Exposed 20,539 Accounts

The Cloud_Rolex_2 Stealer Log Quietly Exposed 20,539 Accounts

HEROIC analysts identified a stealer log named "Cloud_Rolex_2" that surfaced on a public Telegram channel on August 5, 2025. The file contained 20,539 records, including email addresses, plaintext passwords, and the API host URLs tied to each account, with most of the exposed users located in the United States.

Why This Is Dangerous

The passwords in this file were stored in plaintext, so anyone who downloads the log can log straight into an account with no cracking involved. Pairing plaintext passwords with the API host URL for each account hands an attacker the exact address a service uses to authenticate, making it easy to automate login attempts instead of guessing where a stolen password might work.

What Was Exposed

• Email addresses
• Plaintext passwords
• API host URLs

Why This Matters

A leak of over 20,000 records is more than enough to fuel credential stuffing, where stolen email and password pairs are tested automatically against banking apps, email providers, and social media accounts. Anyone who reused one of these 20,539 passwords elsewhere is at risk of account takeover, which can escalate into financial fraud or identity theft.

How a Stealer Log Like Cloud_Rolex_2 Gets Made

Stealer logs are the output of infostealer malware, programs that infect a device through a malicious download or cracked software, then quietly copy every saved password, cookie, and autofill entry they find. The malware bundles the results into a single file and sends it back to whoever controls it. From there, logs like Cloud_Rolex_2 are shared for free or sold on Telegram channels and dark web forums, often with little notice until someone starts looking.

Check If You Are Affected

There is no way to know just by looking whether your email address is part of a stealer log like this one. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records and tells you immediately whether your credentials have been exposed. Run a scan now and change any password that comes back compromised.