Everlasting_Cloud_5 Quietly Exposed 14,261 Passwords This Week

HEROIC analysts quietly picked up a stealer log named "Everlasting_Cloud_5" that surfaced on a Telegram channel on July 29, 2026, just two days before this report. The log contains 14,261 records of email addresses, plaintext passwords, and URLs, including API endpoints, pulled from devices infected with information-stealing malware. Why This Is Dangerous: Because this log was collected so recently, the credentials in it are current, not years old. There was no public announcement or news coverage, the file simply appeared on a Telegram channel where stealer logs are traded, which means anyone whose device was infected may not even know their information is circulating yet. What Was Exposed: - Email addresses - Plaintext passwords - URLs and API endpoints tied to the stolen logins Why This Matters: Fresh stealer logs like this one are especially valuable to attackers because the passwords are far more likely to still be active. Whoever has this file can attempt to log into email, banking, or work accounts right now, and any reused password extends that risk to accounts well beyond the one originally compromised, opening the door to account takeover, identity theft, and financial fraud. How a Stealer Log Like This Works: Infostealer malware infects a device through a malicious download, cracked software, or a phishing link, then silently harvests saved browser passwords, cookies, and autofill data, including logins for cloud services and APIs. The stolen data is bundled by infected machine, given a name like "Everlasting_Cloud_5" to distinguish it from other batches, and shared or sold quietly on Telegram, often with little fanfare until researchers or victims notice. Check If You Are Affected: HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including recent stealer logs like this one, so you can find out in seconds if your credentials were exposed.