Inside the Cloud_Rolex Stealer Log: How Malware Took 1,068 Passwords

Inside the Cloud_Rolex Stealer Log: 1,068 Passwords Exposed

HEROIC analysts identified a stealer log uploaded to a public Telegram channel on October 2, 2025. Labeled Cloud_Rolex, the file contains 1,068 records tied to United States based accounts, made up of email addresses, plaintext passwords, and the URLs each credential was captured from.

Why This Is Dangerous

Even though this is a smaller dataset, the risk to the people in it is just as real. The passwords were captured in plaintext directly from an infected device, so there is no encryption to break and no guessing which site a credential unlocks. Anyone with this file can match an email address to its password and the exact page it opens, then log in right away.

What Was Exposed in the Cloud_Rolex Log

• Email addresses
• Plaintext passwords
• URLs tied to each set of credentials

Why This Matters

A dataset does not need to be huge to be dangerous. Each of the 1,068 exposed email and password pairs is ready-made for credential stuffing, where attackers test the same login across banks, email providers, and shopping sites. Anyone here who reused a password elsewhere faces genuine risk of account takeover, identity theft, and financial fraud.

How a Stealer Log Is Created

A stealer log like Cloud_Rolex is the output of infostealer malware, a program that infects a device through a malicious download, cracked software, or a phishing link. Once installed, it reads saved usernames, passwords, and browsing history directly from the browser, then compiles everything into a single file. That file is then uploaded to Telegram channels and underground marketplaces, exactly where HEROIC analysts found this Cloud_Rolex dump.

Check If You Are Affected

Find out whether your email address is one of the 1,068 exposed in the Cloud_Rolex leak, or in any other breach, with HEROIC's free scanner. It checks your information against a database of more than 400 billion leaked records, so you can act quickly if your credentials are exposed.