DarkPrince_Cloud 666.307: Endpoints Behind 18,685 Stolen Logins

HEROIC analysts logged a third file in the DarkPrince_Cloud 666 series this week: 666.307, uploaded to Telegram and dated 23 Aug 2026. It is the largest of the three, holding 18,685 records of email addresses, plaintext passwords, and the login URLs those passwords unlock. The pattern matches the other two files in the same numbered batch, all pulled from devices infected with credential-stealing malware. Scan your email to check whether your login is part of this specific file.

Why Size Matters Here

At 18,685 records, 666.307 is large enough that an attacker working through it can automate login attempts across many sites at once. Each record includes the exact URL the password belongs to, so there's no manual matching required before the credentials can be tested.

What HEROIC Found Inside 666.307

• Email addresses: the account tied to each stolen password, also useful for phishing.
• Plaintext passwords: stored as readable text, no cracking needed to use them.
• URLs: the specific login pages tied to each set of credentials.

What This Means If You're Affected

Because passwords, emails, and destination URLs are bundled together, account takeover can happen quickly and without warning. If a password from this file is reused on another account, especially email or banking, that risk extends well beyond the original login.

How Stealer Logs Like 666.307 Get Made

This kind of file comes from malware sitting on an infected device, silently exporting saved browser credentials over time. The larger record count in 666.307 likely reflects a device, or set of devices, that stayed infected longer before the data was collected and posted.

Checking Whether You're in the 666.307 File

Run a free scan your email against HEROIC's database first. If it comes back a match, assume the source device may still be compromised: scan it for malware or wipe it before changing passwords, starting with email and financial accounts from a separate, clean device. Do this check for work email addresses as well as personal ones.