The Cloud_Rolex2 Leak Exposed 17,120 US-Based Accounts on Telegram

On January 27, 2026, an anonymous Telegram user uploaded a stealer log file labeled Cloud_Rolex2, exposing 17,120 records of compromised endpoint data. The country attribution for this dataset points primarily to United States-based users, making this a significant domestic credential exposure event. The log contains plaintext passwords, email addresses, and service URLs -- a trifecta of immediately exploitable information. Cloud_Rolex2 appears to be a continuation of the Cloud_Rolex series, suggesting an ongoing, coordinated infostealer campaign targeting US internet users rather than a one-time isolated upload.

Why This Is Dangerous

US-based credential dumps are among the most actively sought after in underground markets. American accounts are associated with higher-value financial services, more extensive cloud infrastructure access, and greater purchasing power -- making them premium targets for fraud, account takeover, and resale. The plaintext passwords in Cloud_Rolex2 require no decryption work from attackers. Combined with the service URLs in the dataset -- which reveal exactly which platforms victims were using -- attackers have a precise, actionable map of each victim's digital footprint. With 17,120 records in this dump alone, the scale of potential US account compromise is substancial, particularly when combined with the earlier Cloud_Rolex upload that preceded it.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs (API hosts and service endpoints tied to US-based accounts)

Why This Matters

The Cloud_Rolex naming series -- with Cloud_Rolex and Cloud_Rolex2 both surfacing in January 2026 -- suggests a coordinated distribution campaign rather than a scattered individual act. HEROIC analysts tracking this series note that named series like Cloud_Rolex often indicate a specific threat actor or group that is actively running infostealer infrastructure and periodically releasing batches of harvested data. The combined total of Cloud_Rolex and Cloud_Rolex2 alone exceeds 39,000 records, a significant tranche of US user credentials released within the same month. This pattern of batched, labeled releases is indicative of a professionalized operation with an ongoing infection funnel -- meaning new victims are being added continuosly even as these dumps are published.

How Stealer Log Breaches Work

Infostealer malware spreads through phishing emails, fake software updates, malicious browser extensions, and cracked software distributed on file-sharing platforms. Once installed on a US user's device, the malware captures saved browser passwords, authentication cookies, API keys, and form-filled credentials. The collected data is structured and transmitted to the attacker's server, then packaged into labeled log files for distribution or sale on Telegram. The Cloud_Rolex series naming convention suggests the operator uses a consistent branding system to organize and distribute their harvested batches -- a hallmark of organized criminal groups rather than opportunistic amateur attackers.

Check If You Are Affected

HEROIC's free scanner checks your email against over 400 billion exposed records, including US-targeted stealer log datasets like Cloud_Rolex2 circulating on Telegram right now. If your credentials appear in this dump, you will see it in your results along with clear next steps to lock down your accounts before attackers do. Run a free scan now at HEROIC -- no account required.