How the CRAKOL CLOUD Malware Campaign Led to 5.9 Million Stolen Logins

HEROIC analysts documented the CRAKOL CLOUD 22M ULP stealer log on February 9, 2025. The file, circulated through a Telegram channel operated by a group using the name CRAKOL CLOUD, contained approximately 22 million lines of URL-login-password data. After processing, analysts confirmed 5,927,999 unique email addresses, each paired with a corresponding plaintext password and the homepage URL of the account that was compromised. The breadth of the dataset points to aggregated output from an infostealer malware campaign targeting users across many different online services.

Why Stolen Login Credentials Tied to Specific Sites Are So Dangerous

When a stealer log includes the URL alongside the email and password, it removes one of the key barriers to account takeover. Attackers do not need to test credentials across many platforms. They know exactly where to use each set. Someone who uses the same password on multiple sites faces compounding risk: every account at that URL is immediately accessible, and so is every other service where that password was reused. Financial accounts, work portals, and email inboxes are all potential targets once an attacker has a working URL-credential pair.

What Was Exposed

• Email addresses (5.92 million unique)
• Plaintext passwords
• Homepage URLs identifying which platform each credential belongs to

Why This Matters for Credential Stuffing and Account Fraud

Combolists like the CRAKOL CLOUD 22M ULP are the primary fuel for credential stuffing attacks. Automated tools load the email-password pairs and fire them against login pages at high speed. Services without rate limiting or multi-factor authentication are particularly vulnerable. A single working credential can lead to account takeover, fraudulent purchases, identity theft, or unauthorized access to connected services. Data from one successful stuffing campaign is often repackaged and sold again, meaning your credentials can circulate for years after the initial exposure.

How the CRAKOL CLOUD 22M ULP Stealer Log Was Created

Stealer logs of this type originate from infostealer malware deployed at scale. The malware typically reaches victims through phishing campaigns, cracked software downloads, or drive-by infections on compromised websites. Once installed on a device, it extracts saved login credentials from browsers, records keystrokes during active login sessions, and harvests any stored authentication tokens. The output is a structured log, formatted as URL:LOGIN:PASS, which attackers then aggregate, deduplicate, and distribute. CRAKOL CLOUD compiled 22 million such lines before posting the finished dataset to Telegram for wide distribution.

Check If You Are Affected by the CRAKOL CLOUD Leak

HEROIC's breach scanner covers more than 400 billion records, including stealer logs like this one. If your email address is part of the CRAKOL CLOUD 22M dataset, your password for the associated site is in the hands of criminals. Search your email now using HEROIC's free breach scanner to learn exactly what was exposed, and take action before an attacker does.