Remote Workers and Cloud Users Targeted in the Cloud_Rolex Telegram Stealer Log Exposing 29,507 Records

In April 2026, a threat actor uploaded a stealer log file named Cloud_Rolex to Telegram, distributing 29,507 records harvested from compromised devices. The file contains plaintext passwords, email addresses, and URLs -- the combination attackers need to access cloud services, remote work tools, and personal accounts. The name itself suggests this log was built targeting cloud environment credentials, making it particularly dangerous for anyone who works remotely or relies on cloud-based tools.

Why This Is Dangerous

Cloud credential theft is among the most damaging forms of data exposure. When attackers obtain valid login credentials for cloud platforms -- whether that is email, file storage, project managment tools, or SaaS applications -- they can access business data, impersonate users, exfiltrate documents, and pivot into connected systems. Stealer logs like Cloud_Rolex are particularly dangerous because they capture credentials in plaintext, paired with the exact URLs of the services being targeted, giving attackers an immediate roadmap into your digital life.

What Was Exposed

• Email Addresses -- used to identify victims and attempt access across services
• Plaintext Passwords -- no cracking required, ready for immediate use
• URLs -- reveal exactly which cloud services and accounts are compromised

Why This Matters

The Cloud_Rolex log was distributed on Telegram in April 2026 -- meaning it has been actively circulating for months. With 29,507 records exposed, this is not a small targeted breach. Attackers who download logs like this typically feed them into automated credential stuffing tools that test every username and password combination against dozens of platforms simultaniously. If you use the same password across multiple services, a single hit in this log could expose far more than one account.

How Stealer Logs Work

Information-stealing malware infects devices through phishing emails, fake software downloads, or malicious browser extensons. Once active, it captures every credential entered into a browser -- including the URL of the site -- and bundles the stolen data into a log file. These logs are then posted to Telegram channels where they are downloaded by thousands of cybercriminals within hours. The malware often targets cloud applications specifically because they hold the most valuable data and often act as a gateway to additional connected systems.

Check If You Are Affected

HEROIC's free scanner searches over 400 billion exposed records -- including stealer logs like Cloud_Rolex -- to tell you if your email and credentials have been compromised. If you rely on cloud services or remote work tools, checking now is critical. Run a free scan today and take action before an attacker uses your data to acces your accounts and everything connected to them.