Everlasting_Cloud_2 Leak Puts 20,736 Logins at Fraud Risk

HEROIC analysts identified a stealer log file named Everlasting_Cloud_2 circulating on a criminal Telegram channel on August 26, 2026. The file contained 20,736 records, each one pairing a saved login with the site it came from and the password typed into it. Because a stealer log pulls straight from an infected device rather than from a company's servers, the only reliable way to know whether your information is part of this file is to scan your email.

Why This Is Dangerous

Every password in this file was stored as plain, readable text. Nothing needs to be cracked or decoded; anyone holding the file can copy a login and use it immediately. If any of these passwords match ones you still use elsewhere, an attacker does not need to guess, they only need to try.

• Email addresses
• Plaintext passwords
• URLs tied to each saved login

Records like these get tested against banking portals, email providers, and workplace logins within hours of surfacing, a process criminals call credential stuffing. A single reused password can hand over a mailbox, and a mailbox is usually the key to resetting everything else, from cloud storage to financial accounts.

A stealer log comes from malware running quietly on an infected computer, capturing whatever the browser had saved, including usernames, passwords, and the exact web addresses they belonged to. The person behind that device did not have a company breached on their behalf; their own machine did the leaking. That is why this file spans so many unrelated sites rather than customers of one service.

Check Whether Your Email Was Exposed

Start by taking a moment to scan your email against this and other known exposures. If it turns up a match, change the password on that account right away and update it anywhere else you reused it, switching to a unique password each time. This matters whether the address in question is one you use personally or one tied to your job; both are worth checking.