How Infostealer Malware Exposed 639,436 Cloud T96 Passwords

HEROIC analysts traced a stealer log named cloud t96 to a Telegram upload dated 30 June 2026. The file contains 639,436 records, each combining an email address, a plaintext password, and the exact URL that login was captured from. The sheer scale of this leak makes it one of the larger stealer log releases tracked in recent weeks.

Why the Cloud T96 Leak Is Dangerous

What makes this leak dangerous is not just the volume but the format. Every password sits in plaintext, and every entry is matched to its login page, so an attacker can start using the data immediately without cracking a single hash. At this scale, even a small success rate still means tens of thousands of working accounts.

What Was Exposed in the Cloud T96 Stealer Log

• Email addresses
• Plaintext passwords
• Associated login URLs

Why This Matters for Anyone in the Data

Reused passwords are what turn a single stealer log into a mass casualty event online. Criminals feed leaked credentials into hundreds of sites through credential stuffing, hunting for matches. When they find one, the result is often account takeover, identity theft, or direct financial fraud, and a leak of this size gives them enormous room to work with.

How Malware Exposed These 639,436 Passwords

Stealer logs like cloud t96 come from infostealer malware, which sneaks onto a device through a cracked program, a pirated download, or a phishing link disguised as an urgent message. Once running, it quietly extracts saved browser passwords, cookies, and autofill data. To reach this volume, the operator likely combined data from hundreds or even thousands of infected devices before releasing the seperate file as one large upload.

Check If You Are Affected by This Breach

With over 639,000 records involved, checking your exposure is worth doing right away. HEROIC's free breach scanner searches a database of more than 400 billion leaked records, including this cloud t96 dump, and gives you an instant answer. Run a free scan today and reset any password that comes back exposed.