Everlasting_Cloud_4 Leak: 3,716 Passwords Now at Risk

HEROIC analysts identified a stealer log named Everlasting_Cloud_4 posted to Telegram on 20-Jun-2026. The file contained 3,716 exposed records taken directly from compromised devices, pairing email addresses with plaintext passwords and the exact URLs each login unlocks.

Why This Is Dangerous

The real danger here is not the leak itself, it is what happens next. Once a log like this circulates, it gets copied, resold, and tested against countless other accounts. What starts as one exposed login can end with a drained bank account or a hijacked email inbox.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated login URLs

Why This Matters

Every reused password in this log is a potential domino. Attackers run credential stuffing tools that test stolen logins across dozens of sites in seconds. If even one match lands on a banking or email account, the consequences escalate fast, from account takeover to identity theft to direct financial fraud.

How Stealer Logs Work

Stealer malware typically arrives disguised as free software, a game cheat, or a cracked app. Once it runs, it silently harvests saved browser passwords, autofill data, and cookies, then uploads the haul to the attacker. That data is packaged into a log, in this case Everlasting_Cloud_4, and shared or sold on Telegram, where it can be downloaded by anyone.

Check If You Are Affected

The sooner you know, the smaller the consequences. HEROIC's free breach scanner checks your email against more then 400 billion leaked records, including logs like this one, so you can change exposed passwords before someone else uses them.