Dark Web Intel: 4,875 Credentials From the Everlasting_Cloud_2 Log

Dark Web Intel: A Second Everlasting_Cloud_2 Stealer Log Surfaces

HEROIC analysts found another stealer log file cataloged as "Everlasting_Cloud_2," this one uploaded to a public Telegram channel on September 18, 2025. The file contains 4,875 records tied to users in the United States, each pairing an email address with a plaintext password and the URL of the site or service it unlocks.

Why This Is Dangerous

Because the passwords in this file were captured in plaintext, an attacker does not need to crack or guess anything before using them. Every record already links a working password to the exact site it opens, so the gap between finding this file and breaking into an account is close to zero.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the sites and services tied to each login

Why This Matters

A file this size is more than enough to fuel credential stuffing attacks against banking, email, and shopping accounts. Anyone whose password shows up here faces a real risk of account takeover, and if that password was reused elsewhere, the risk extends to identity theft and financial fraud on other accounts entirely.

How the Everlasting_Cloud_2 Stealer Log Was Built

Stealer logs like this one come from malware that infects a device, often through a pirated download, fake update, or malicious attachment, then quietly copies saved browser passwords, autofill entries, and visited URLs. That data is packaged into a log file and sent back to whoever controls the infection. From there, logs are traded or dumped into Telegram channels, exactly where HEROIC's dark web monitoring found this one.

Check If You Are Affected

If you want to know whether your credentials appear in this leak or any other exposed dataset, HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records. Run a scan now and change any password that comes back compromised.