Dark Web Intel: 3,671 Credentials From the Cloud_Rolex_2 Stealer Log

Dark Web Intel: 3,671 Credentials From the Cloud_Rolex_2 Stealer Log

HEROIC analysts identified a stealer log uploaded to a public Telegram channel on October 2, 2025. Labeled Cloud_Rolex_2, the file contains 3,671 records tied to United States based accounts, made up of email addresses, plaintext passwords, and the URLs each credential was captured from.

Why This Is Dangerous

These passwords were pulled directly from infected browsers in plaintext, so there is no encryption for an attacker to defeat. Each email address is already paired with its real password and the exact site it opens, meaning anyone monitoring dark web channels for fresh logs like this one can start using the credentials the moment it appears.

What Was Exposed in the Cloud_Rolex_2 Log

• Email addresses
• Plaintext passwords
• URLs tied to each set of credentials

Why This Matters

Logs like this circulate through the same dark web channels that power credential stuffing, where stolen email and password pairs are automatically tested against banks, email providers, and shopping sites. Anyone among the 3,671 exposed accounts who reused a password elsewhere faces genuine risk of account takeover, identity theft, and financial fraud tracing back to this exposure.

How Stealer Log Breaches Work

A stealer log is produced by infostealer malware that infects a device through a malicious download, cracked software, or a phishing link. Once installed, it reads saved usernames, passwords, and browsing history directly from the browser, then compiles everything into a single file. That file is then uploaded to Telegram channels and dark web marketplaces, exactly where HEROIC analysts found this Cloud_Rolex_2 dump.

Check If You Are Affected

Find out whether your email address is one of the 3,671 exposed in the Cloud_Rolex_2 leak, or in any other breach, with HEROIC's free scanner. It checks your information against a database of more than 400 billion leaked records, so you can act before your credentials are misused.