Everlasting_Cloud Leak Targets Anyone With Saved Browser Logins

HEROIC analysts discovered a stealer log called Everlasting_Cloud circulating on Telegram on August 25, 2026, containing 24,271 email and plaintext password pairs, each tied to the exact site it unlocks. The only way to know if your own email turned up in this discovery is to scan it for free.

Who Ends Up in a File Like This

Everlasting_Cloud does not target one company or one group of people. It targets whoever happened to have their browser logins saved on the specific devices this malware infected, meaning the 24,271 people in this file likely span dozens of unrelated services and backgrounds.

What Everlasting_Cloud Contains

• Email Addresses: point to a working inbox.
• Plaintext Password: readable immediately, with nothing to crack.
• URLs: identify the exact site or service each login opens.

Why Being a Random Target Doesn't Make You a Safe One

Malware like this does not pick victims based on who they are, only on which device it managed to infect. That randomness means the risk applies just as much to a reader with no reason to think they would ever be targeted as it does to anyone else.

How a File Like This Ends Up With 24,271 Records

Stealer malware on infected devices quietly records saved browser logins as people use them, and the operator behind this release combined captures from enough devices to reach this count before releasing the file on Telegram.

Did the Everlasting_Cloud Discovery Include You?

Use the link below to scan your email and find out directly. If it did, treat the device behind the leak as compromised, clean it, and reset your passwords from a separate device, giving a work email the same urgency as a personal one.