Our Analysts Found the Everlasting_Cloud_2 Dump Circulating in Private Telegram Channels

In April 2026, security researchers monitoring underground Telegram channels identifed a stealer log file called Everlasting_Cloud_2 being distributed among threat actors. The file contained 22,149 records -- email addresses, plaintext passwords, and the URLs where those credentials were in use. The discovery confirmed an active campaign by the same distributor behind the original Everlasting_Cloud log, signaling that this is not a one-off leak but part of a coordinated, ongoing effort to harvest and sell stolen credentials.

Why This Is Dangerous

The Everlasting_Cloud_2 file was found actively circulating in private Telegram groups where cybercriminals trade stolen data. This is not a breach that sat dormant -- by the time analysts discovered and catalogued it, the credentials had already been exposed to multiple threat actors. Stealer logs of this type are immediately weaponized for credential stuffing, account takeover, and identity fraud. The plaintext nature of the passwords in this file means no cracking is required: anyone who downloaded it can use the credentials directly.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs (specific login endpoints and API hosts associated with each credential pair)

Why This Matters

The Everlasting_Cloud_2 file is the second in a series from the same distributor, meaning this threat actor is systematically harvesting and releasing credential batches over time. With 22,149 records in this release alone, and a prior batch already in circulation, the cumulative exposure is substanstial. For individuals in either file, the risk is not limited to one account -- password reuse means a single compromissed credential can unlock multiple services including email, banking, and cloud storage.

How Stealer Log Breaches Work

Stealer logs like Everlasting_Cloud_2 originate from malware infections -- info-stealers such as RedLine, Raccoon, and Vidar that silently run on a victim's device and harvest credentials saved in browsers and applications. The attacker collects the harvested data on a command-and-control server, packages it into named log files, and distributes it through private Telegram channels. The series naming convention (Cloud, Cloud_2) is common among prolific distributors who release batches on a rolling schedule to maintain demand and pricing in criminal marketplaces.

Check If You Are Affected

HEROIC's free breach scanner searches more than 400 billion exposed records, including the Everlasting_Cloud and Everlasting_Cloud_2 stealer log files, to tell you instantly whether your email address has been compromised. Enter your email below to run a free scan and find out if your credentials are currently in circulation among cybercriminals.