cvv190_cloud Stealer Log Leak Exposes 1,123 Stolen Passwords

HEROIC analysts identified a stealer log uploaded in August 2026 under the name cvv190_cloud, containing 1,123 records taken from infected devices. Each record pairs an email address with a plaintext password and the URL where that login was captured. Because this data came from malware rather than any official notice, scanning your email is the only reliable way to see if you're affected.

Why This Is Dangerous

With passwords stored in plaintext, there's no barrier between this file and someone trying to use it right now. No cracking, no waiting, just a working email and password pair sitting next to the exact site it unlocks. That immediacy is what separates a file like this from a leak of properly hashed credentials.

What Was Exposed

• Email Addresses
• Plaintext Password
• URLs

Credentials from a file like this usually get tested first against the listed URL, then against other popular services on the chance the same password was reused. That's often how a single exposed login turns into several compromised accounts, sometimes reaching email, banking, or shopping sites the victim never expected to be at risk. The damage can spread quietly for weeks before anyone notices.

A stealer log such as cvv190_cloud comes from malware installed on a victim's own device, quietly logging every website visited along with the username and password typed in, then sending that record back to whoever runs the infection. That's different from a company's servers being compromised, since the point of failure is the infected device itself. It also means the list keeps growing for as long as that malware stays undetected.

See If Your Login Is Part of This

Scan your email now to check whether it shows up in this file or related ones.

• If it matches, change that password immediately, along with any other account where you've used the same one.
• Scan the device tied to that login for malware, since the source of this leak may still be running.

Do this check for work email accounts as well as personal ones.