The Cloud_Rolex Leak: 10,274 Records Give Attackers Full Access

A Stealer Log Named "Cloud_Rolex" Exposed 10,274 Records

HEROIC analysts tracked a stealer log file called "Cloud_Rolex" that appeared on a Telegram channel on September 9, 2025. The file held 10,274 records lifted directly from infected devices, pairing email addresses with plaintext passwords and the URLs of the accounts those credentials belong to.

Why This Is Dangerous

Every password in this log is stored in plaintext, meaning there is no encryption standing between the file and an attacker's screen. Combined with the matching email address and account URL, a criminal can log straight into the account with no cracking or guesswork required. That removes the biggest obstacle attackers usually face after obtaining stolen data.

What Was Exposed

• Email addresses
• Plaintext passwords
• Account and login URLs

Why This Matters

Because plaintext credentials work the instant they are copied, this data is immediately usable for account takeover. Attackers routinely feed exposed email and password pairs into credential stuffing tools, testing them against banking sites, email providers, and social platforms in the hope that the password was reused. Anyone whose credentials appear in this log faces a real risk of financial fraud and identity theft if they have reused that password anywhere else.

How Stealer Logs Work

Stealer logs come from infostealer malware, malicious software that infects a device and quietly copies saved browser passwords, autofill entries, and session details before sending them to the attacker controlling it. The results are then bundled into files like "Cloud_Rolex" and traded or shared on channels like Telegram. Because the malware pulls credentials directly off the infected device, a single log like this can expose access to dozens of unrelated accounts and services at once.

Check If You Are Affected

HEROIC's free breach scanner checks your email address against a database of more than 400 billion leaked records, including stealer logs like this one. Run a free scan to find out if your credentials were part of this leak and learn how to secure your accounts.