40,147 Passwords From the Cloud_Rolex Telegram Log Just Surfaced

HEROIC analysts identified a stealer log file uploaded to a public Telegram channel on May 26, 2025. The file contained 40,147 records harvested from infected devices, including email addresses, plaintext passwords, and URLs pointing to the services those devices had accessed. The data types suggest the malware captured credentials directly from browsers and active sessions, not from a company database breach.

Why This Is Dangerous

Every record in this log is a ready-to-use login. Because the passwords are stored in plaintext, an attacker does not need to crack anything. They can take any email and password pair from this file and attempt to sign in to Gmail, banks, shopping sites, or workplace tools right now. The included URLs also tell attackers exactly which services each person was using, letting them priortize the highest-value targets first.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs (accessed services and API endpoints)

Why This Matters

When plaintext passwords leak alongside email addresses, the risk of account takover is immediate. Most people reuse passwords across multipple services, which means one stolen credential can open doors to email inboxes, cloud storage, financial accounts, and workplace systems. Attackers bundle logs like this one and run them through automated tools that test thousands of logins per minute. Even a single successful match can result in identity theft or financial fraud.

How Stealer Logs Work

A stealer log is created by infostealer malware, a type of malicious software that silently installs itself on a device, often through a fake download, phishing link, or compromised software update. Once installed, it records everything saved in the browser, including passwords, cookies, and autofill data, then sends it back to the attacker in a structured log file. Those files are then sold or shared in Telegram channels and dark web markets, sometimes within hours of collection. The infected device owner often has no idea anything happened.

Check If You Are Affected

HEROIC has indexed over 400 billion leaked records, including data from stealer logs like this one. You can search your email address for free using the HEROIC Identity Monitor to find out if your credentials have been exposed. If your information appears, change your passwords immediately and enable two-factor authentication on every account you care about.