HEROIC Found Cloud Rolex Stealer Credentials on Telegram

In December 2025, HEROIC identified 18,857 records from a stealer log file uploaded to Telegram by an anonymous user under the name Cloud_Rolex. The data was shared publicly and contained email addresses, plaintext passwords, and URLs of compromised endpoints.

Why the Cloud Rolex Stealer Log Is Dangerous

HEROIC's threat intelligence team found this credential collection on a public Telegram channel used by cybercriminals to distribute stolen access data. The Cloud_Rolex log stands out because every record pairs an email address with a plaintext password and the exact URL of the service where the credentials were used. That context-aware structure lets attackers target specific accounts directly rather than guessing where a reused password might work.

What Was Exposed in the Cloud Rolex Leak

• Email addresses
• Plaintext passwords
• URLs of compromised endpoints

Why This Cloud Rolex Data Puts You at Risk

With 18,857 plaintext credential sets available to anyone monitoring the Telegram channel, this log rapidly circulated through the criminal ecosystem. Attackers use the URL data to access the exact accounts captured by the malware, then test the same credentials against banking, e-commerce, and email platforms the victim may also use. The scale -- nearly 19,000 records -- supports both automated account takeover campaigns and manual targeting of high-value accounts identified in the data.

How Stealer Log Breaches Work

Infostealer malware spreads through phishing campaigns and compromised downloads. Once on a victim's device, it silently records browser-based login sessions -- capturing the email address, the password, and the URL of every site where credentials are entered. These records are bundled into a log file and exfiltrated to the attacker's infrastructure. The Cloud_Rolex log was assembled from multiple such infections before being uploaded to Telegram for public distribution.

Check If Your Data Was Exposed

HEROIC operates one of the world's largest breach databases, covering more than 400 billion leaked records. Use HEROIC's free breach scanner to check if your email address or credentials appeared in this stealer log or thousands of other breaches in our database.