Dark Web Intel: 9,617 Credentials From the Cloud_Rolex Stealer Log

Dark Web Intel: The "Cloud_Rolex" Stealer Log Exposed 9,617 Records

HEROIC analysts tracked a stealer log file called "Cloud_Rolex" that appeared on a Telegram channel on September 2, 2025. The file contained 9,617 records taken directly from infected devices, pairing email addresses with plaintext passwords and the URLs of the accounts those credentials belong to.

Why This Is Dangerous

The passwords in this log are stored in plaintext, so there is nothing standing between having the file and using the credentials. Matched with a corresponding email address and account URL, an attacker can log in immediately, without needing to crack or guess anything.

What Was Exposed

• Email addresses
• Plaintext passwords
• Account and login URLs

Why This Matters

Dark web channels like the one this log surfaced on give attackers fast, direct access to fresh credentials. Because so many people reuse passwords, a single exposed plaintext password from this log can unlock accounts on other sites entirely unrelated to where it was originally stolen. That reuse is exactly what powers credential stuffing attacks, and it is what turns a modest leak like this one into a real risk of account takeover, identity theft, and financial fraud.

How Stealer Logs Work

A stealer log is generated by infostealer malware, which infects a device and silently harvests saved browser passwords, autofill data, and session details before sending them to whoever is running the malware. The results are then packaged into files like "Cloud_Rolex" and traded across dark web and Telegram channels. Because the malware captures credentials directly from the device, one log can expose access to many unrelated accounts and services at once.

Check If You Are Affected

HEROIC's free breach scanner checks your email address against a database of more than 400 billion leaked records, including stealer logs like this one. Run a free scan to see if your credentials were exposed and get guidance on securing your accounts.