Plaintext Passwords Leaked in DragonCloudBudget Breach

HEROIC researchers found 13,092 records on November 4, 2024 from DragonCloudBudget 901 PCS, a stealer log uploaded to a public Telegram channel.

Why This Stealer Log Is Dangerous

DragonCloudBudget 901 PCS is not a hashed password dump, it is a stealer log packed with live plaintext credentials paired to the URLs where they work. That removes every hurdle between an attacker and a successful login, and it turns a single record into a potential doorway into corporate email, cloud tenants, or financial tools.

What Was Exposed in DragonCloudBudget 901 PCS

• Email addresses
• Plaintext passwords
• Login URLs and API host endpoints
• Browser-saved credentials and session data from infected endpoints

Why This Matters

Plaintext passwords let attackers skip cracking and immediately test logins across banking, email, SSO, and cloud services. With 13,092 records shared on Telegram, this dump is prime feedstock for credential stuffing, business email compromise, and the initial access broker economy that fuels ransomware.

How a Stealer Log Like DragonCloudBudget Works

An infostealer such as RedLine, Lumma, or Vidar infects a victim device through cracked software, malvertising, or phishing. It quietly harvests saved browser logins, cookies, cloud credentials, and crypto wallet files, then sends everything to an operator. Operators bundle the results into branded drops like DragonCloudBudget 901 PCS and publish them on Telegram for other criminals to grab.

Check If You Are Affected

HEROIC scans 400B+ exposed records across stealer logs, dark web markets, and breach dumps so you can instantly see if your accounts appear in drops like DragonCloudBudget 901 PCS. Run a free HEROIC scan now and rotate any compromised passwords.