2,926 Cloud Users Exposed in the Everlasting Cloud TG ArhontCorp Leak

HEROIC analysts found a stealer log called Everlasting Cloud TG ArhontCorp, uploaded to Telegram on August 16, 2026, holding 2,926 records of email addresses, plaintext passwords, and the URLs tied to each login. Like other stealer logs, this data was harvested from individual infected devices rather than pulled from one company's systems. Scan your email to check whether you are in this file.

The danger here comes from how usable this data already is. The passwords were stored as plain, readable text, so there is no hashing or encryption standing between an attacker and your login. Add the matching URL for each password, and an attacker has a ready-made list of accounts to log into immediately.

What This Stealer Log Contains

• Email Addresses: identifies the victim and gives attackers a channel for phishing attempts.
• Plaintext Passwords: usable the moment the file is opened, with no cracking required.
• URLs: point to the exact account each password belongs to, speeding up account takeover.

Who This Puts at Risk

Anyone whose device was infected by the malware behind this log is exposed, regardless of what kind of accounts they use day to day. Cloud storage logins, personal email, and any site saved in a browser are all fair game once a device is compromised. If a password from this file was reused anywhere else, those other accounts are vulnerable too, since attackers routinely test leaked credentials against banking, shopping, and social media sites.

Inside a Stealer Log Like This One

Stealer logs come from malware quietly running on a victim's computer or phone, capturing saved browser passwords, autofill details, and the web addresses they belong to. Once enough data has been collected, the operator bundles it into a single file and distributes it, often through Telegram channels like the one this file surfaced on. No company network needs to be breached for this to happen; one infected device is enough.

If You Were Part of the Everlasting Cloud Leak

Scan your email first to see if you appear in this file. If there is any chance your own device is infected, run a malware scan and clean it before changing anything, otherwise a new password could be captured the same way the old one was. Once your device is clean, change the password for every account tied to the leaked URLs, and avoid reusing the same password across personal and work accounts going forward.