28,580 Records Pulled From Everlasting_Cloud_2 Stealer Log Breach

HEROIC discovered 28,580 records exposed in the Everlasting_Cloud_2 stealer log breach on March 24, 2026. A Telegram user published the archive, which contained email addresses, plaintext passwords, and API host URLs pulled from tens of thousands of infected endpoints.

Why This Stealer Log Is Dangerous

At 28,580 records this is the largest dump in the current HEROIC watchlist, giving attackers an immediate pool of live credentials to weaponize. The Everlasting_Cloud naming pattern signals that this is part two of an ongoing release series, meaning victims may appear across multiple packs. Plaintext passwords and exposed API hosts combine to create a fast path from stolen login to full account takeover.

What Was Exposed in Everlasting_Cloud_2

• Email addresses tied to 28,580 infected endpoints
• Plaintext passwords ready to load into cracking tools
• API host URLs pointing at backend services
• Browser cookies, autofill, and saved sessions
• Device fingerprints useful for further targeting

The scale makes this one of the most consequential stealer log drops observed this month.

Why This Matters

Large-volume stealer logs like Everlasting_Cloud_2 are used as feedstock for automated credential stuffing targeting banks, gaming platforms, SaaS tools, and enterprise admin portals. Because the data is fresh, passwords have likely not been rotated, giving attackers weeks of runway. Enterprises should hunt for unusual logins, session reuse, and OAuth anomalies tied to affected email addresses.

How a Stealer Log Like Everlasting_Cloud_2 Works

Infostealers such as Lumma, Vidar, and RedLine plant themselves on endpoints through cracked installers, phishing lures, or malicious ads. They dump browser password stores, cookies, wallet files, and autofill fields into a log, then ship the archive to the operator. The operator combines many logs into releases like Everlasting_Cloud_2 and posts them on Telegram for resale or free distribution.

Check If You Are Affected

HEROIC monitors the world's largest breach database with over 400 billion compromised records. Run a free scan to see if your email, passwords, or accounts appear in the Everlasting_Cloud_2 leak or other major breaches.