Cloud Users Targeted: MetaCloudVipNew 4050 PCs.part4 Exposes 28,041 Records

HEROIC analysts catalogued the MetaCloudVipNew 4050 PCs.part4 stealer log in January 2026, finding 28,041 records uploaded by a Telegram user from infected endpoints tied to MetaCloudVip users. The dataset included email addresses, plaintext passwords, and URLs, all pulled directly from machines compromised by stealer malware targeting cloud service users.

Why This Is Dangerous

Cloud service users are a high-value target for stealer malware operators because they tend to have credentials stored across many connected platforms. A single infected machine used to access cloud dashboards, APIs, or hosted services can expose not just personal accounts but also business systems and shared environments that extend the breach well beyond one individual.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs (cloud and web services the victims accessed while infected)

Why This Matters

When cloud users lose credentials through stealer malware, the impact can ripple outward quickly. Credential stuffing attacks use these stolen logins to access email, payroll, and financial platforms. Account takeovers can lead to data theft, ransomware deployment, and identity fraud that damages both individuals and the organizations they work for.

How Stealer Logs Work

Stealer malware targets cloud users the same way it targets everyone else, through phishing emails, compromised downloads, and malicious extensions. Once installed, it sweeps through saved browser credentials, session cookies, and bookmarked URLs, paying special attention to cloud dashboards and API login pages. The harvested data gets assembled into a log and exfiltrated to the attacker's server, then shared across Telegram channels and dark web markets for others to exploite.

Check If You Are Affected

HEROIC's free scanner searches more than 400 billion exposed records including stealer logs like MetaCloudVipNew 4050 PCs.part4. If your email shows up in this or any other breach, you will be alerted right away. Run your free check now at HEROIC.com and stay ahead of the attackers targeting cloud users.