The Cloud_Rolex Leak Exposed 16,619 US Accounts on Telegram in 2025

HEROIC analysts discovered a stealer log file posted to a public Telegram channel on June 11, 2025. The file, identified as Cloud_Rolex, contained 16,619 records harvested from compromised endpoints in the United States. Each record included an email address, a plaintext password, and URLs tied to API hosts and web-facing services. The dataset appears to be the first volume in a series, with Cloud_Rolex_2 surfacing the following day, suggesting an active and ongoing harvesting operation at the time of the leak.

With 16,619 ready-to-use credential pairs circulating on a public Telegram channel, the window for attackers to exploit this data opened immediatly. Plaintext passwords require no additional processing. Anyone who downloaded this file could begin testing credentials against email providers, banks, and business platforms within minutes.

What the Cloud_Rolex Stealer Log Exposed

• Email addresses linked to active online accounts
• Plaintext passwords, directly usable without cracking
• URLs pointing to API hosts and connected web services
• Endpoint data identifying the compromised devices

Why the Cloud_Rolex Breach Puts US Accounts at Serious Risk

The United States accounts for a large share of high-value online accounts, from financial services to cloud platforms to corporate systems. When a stealer log targeting US endpoints surfaces on Telegram, the exposed credentials become a direct threat to email inboxes, bank accounts, social media profiles, and workplace tools. Because most people reuse passwords across services, one compromised credential in this dataset can cascade into multiple account takeovers for the same victim.

The API host URLs in the Cloud_Rolex dataset indicate that at least some victims were accessing developer platforms or cloud services from the infected devices. These credentials carry elevated risk because compromising an API key can give an attacker read and write access to underlying infrastructure, not just a single user account. Financial fraud, identity theft, and unauthorized access to business systems are all realistic outcomes from credential exposure of this type.

The fact that Cloud_Rolex was followed by Cloud_Rolex_2 within 24 hours signals that this was not a one-time event. It points to a systematic, volume-driven operation designed to distribute as many credentials as possible to as many bad actors as possible.

How Stealer Logs Target and Harvest Credentials

Infostealer malware is engineered to be invisible while it works. A victim typically contracts it through a phishing email, a fake software download, or a browser extension with hidden malicious code. Once the malware is running, it sweeps through the device looking for stored credentials: saved passwords in Chrome, Edge, and Firefox, VPN login files, email client credentials, and any autofill data stored in the browser.

The malware bundles everything into a structured log file and transmits it to the operator without triggering a security alert on most home or small business systems. The Cloud_Rolex naming convention, with numbered volumes, is a common pattern among prolific stealer log operators who run continuous campaigns and release data in batches to maintain relevance in underground communities. Victims frequently have no idea their credentials were compromised untill they see an unauthorized login notification weeks or months later.

Check If You Were Exposed in the Cloud_Rolex Breach

HEROIC's free breach scanner searches across more than 400 billion leaked records, including stealer log data from the Cloud_Rolex series. Enter your email address to check whether your credentials appeared in this June 2025 dataset or any other breach in our database.

If your email shows up in the results, change the exposed password on every service where you used it, turn on two-factor authentication for your email and financial accounts, and review your recent login history for any access you do not recognize.