The Cloud_Rolex_3 Leak Has More Stolen Logins Than a Concert Hall

HEROIC analysts discovered the Cloud_Rolex_3 stealer log file on July 9, 2025, after an anonymous user posted it to a public Telegram channel. The file contained 28,209 records stolen from infected devices, each one pairing an email address with a plaintext password and the URL of a cloud API host the victim was using. The scale of the collection and the presence of unencrypted passwords made this an immediately actionable threat for anyone whose credentials appeared in the file.

Plaintext passwords require no decryption before use. Any attacker who downloaded this file had a ready-made list of working email and password pairs that could be tested against banking sites, email providers, and social platforms within hours. The API host URLs included in the dataset also indicate that some victims may be developers or business users whose work accounts were compromised alongside personal ones.

What Was Exposed in the Cloud_Rolex_3 Stealer Log

• Email addresses (primary identifiers for online accounts)
• Plaintext passwords (unencrypted, immediately usable without any cracking)
• Cloud API host URLs (indicating which services and platforms the victims were accessing)

Why the Cloud_Rolex_3 Leak Is a Credentail Stuffing Risk

Credential stuffing attacks rely on the simple fact that most people reuse passwords. When an attacker has a list of 28,209 email and password pairs, automated tools can test each combination across hundreds of websites in minutes. A single match on a banking site, a work email account, or a cloud storage service can lead to financial fraud, data theft, or unauthorized access to business systems.

The inclusion of cloud API host URLs narrows down which services to target first. Attackers do not need to guess where victims have accounts. They already know which platforms those users were actively logged into when their device was compromised. This intelligence makes credential stuffing attempts far more efficient and the likelihood of a successful account takeover much higher.

Identity theft is another real consequence. Email account access alone gives an attacker the ability to reset passwords on every other service linked to that address, creating a chain of account takeovers that can be difficult to fully reverse once it has started. Many victims do not realise they have been compromised until weeks later, long after the damage has occured.

How the Cloud_Rolex_3 Stealer Log Was Built

Stealer logs are assembled by information-stealing malware installed on victims' computers without their knowledge. Once active, the malware captures saved passwords from web browsers, autofill data stored in apps, session cookies, and any credentials entered into login forms. It also records the URLs associated with those credentials, which is why logs like Cloud_Rolex_3 include both passwords and the addresses of the services they belong to.

The malware sends everything back to the attacker, who then packages the collected data into structured files for sale or distribution. In this case the file was posted openly on Telegram, meaning anyone with access to the channel could download it for free. The name "Cloud_Rolex_3" suggests this may be one of several batches in an ongoing collection, with earlier versions likely containing seperate sets of victim records.

Check If You Were Caught in the Cloud_Rolex_3 Leak

HEROIC's free breach scanner searches a database of over 400 billion exposed records. If your email address appeared in the Cloud_Rolex_3 stealer log or any other known data breach, the tool will tell you exactly what was exposed and which passwords need to be changed immediately. Enter your email at HEROIC's breach search tool to find out. The sooner you check, the better your chances of acting before attackers do.