US Users Hit as Everlasting_Cloud_2 Leak Exposes 69,021 Logins

On May 21, 2026, a file labeled Everlasting_Cloud_2 showed up in a Telegram channel that specializes in trading stolen credentials, and inside it sat 69,021 individual records pulled straight off infected computers in the United States.

Why This Is Dangerous

Stealer logs like this one are dangerous because they don't just hand over a username and password pair, they hand over the entire browsing session a victim had running when their machine got infected. That means whoever downloads this file can walk straight into email inboxes, banking portals, or work accounts without needing to guess or crack anything. The passwords sitting in Everlasting_Cloud_2 were stored in plaintext, so there is no encryption standing between the data and anyone who wants to use it.

What Was Exposed

• 69,021 individual credential records tied to US-based victims
• Email addresses connected to each infected session
• Plaintext passwords with zero hashing or scrambling applied
• URLs showing exactly which websites and services each password unlocks

Why This Matters

When a password shows up next to the exact web address it opens, credential stuffing gets a lot easier for criminals. They don't have to guess whether a login works on your bank or your email, the file practically hands them a map. And because so many people still recieve one password across multiple sites, a single leaked login from Everlasting_Cloud_2 could unlock several accounts belonging to the same person.

How Stealer Logs Work

This kind of breach usually starts with malware quietly installed through a cracked software download, a fake browser update, or a malicious email attachment. Once it's running, the malware scrapes saved passwords, autofill data, and active browser cookies straight from the infected device, then bundles everything into a log file and ships it back to whoever controls the malware. From there it's sold or, in this case, dumped for free on Telegram where anyone can grab a copy. The victim often has no idea it occured until their accounts start behaving strangely.

Check If You Are Affected

Rather than wonder whether your email showed up in Everlasting_Cloud_2 or one of the hundreds of other logs circulating right now, run it through HEROIC's free dark web scanner. HEROIC continuously monitors more than 400 billion (400B+) leaked records pulled from breaches, stealer logs, and combolists, so you can check your email in seconds and get alerted the moment something new turns up tied to your identity.