US Stealer Log “cvv190_cloud_2” Leaks 13,905 Stolen Passwords

US-Focused "cvv190_cloud_2" Stealer Log Surfaces on Telegram

HEROIC analysts identified a stealer log named "cvv190_cloud_2" that a Telegram user uploaded on 26-Jul-2026. The file is tied to accounts in the United States and contains 13,905 records made up of email addresses, plaintext passwords, and the URLs those logins were captured from.

Why This US-Linked Stealer Log Is Dangerous

At nearly 14,000 records, this is one of the larger stealer logs HEROIC analysts have tracked recently, and it concentrates that risk on US accounts specifically. Because every password sits in plaintext and is paired with the exact site it unlocks, an attacker does not need to do any extra work, they can go straight to the listed URL and log in using the exposed credentials.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs identifying which site each login belongs to

Why This Matters

With nearly 14,000 records in play, this leak creates real account takeover risk at scale. Anyone in this log whose password shows up in plaintext should assume an attacker could log into that account today. If the same password was reused on other sites, the exposure extends to those accounts too through credential stuffing.

How Stealer Logs Work

Stealer logs are produced by malware that infects a device and silently copies whatever is saved in the browser, including passwords, autofill entries, and site URLs. Once collected, that data is packaged into a single file and delivered to the attacker, who often shares or sells it in Telegram channels like the one this log was pulled from.

Check If You Are Affected

With a leak this size, it is worth checking your exposure directly rather than assuming you are not affected. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including stealer logs like this one, and tells you immediately if you were exposed. Run a free scan and change any password it flags.