Device Users Targeted in Flores Private Cloud 77 Leak: 14,923 at Risk

HEROIC analysts found a stealer log named Flores Private Cloud 77 uploaded to Telegram on August 30, 2026. The file contains 14,923 records of endpoints, email addresses, API hosts, and passwords pulled from infected devices. Scan your email to check if your address is among them.

Unlike a list built from old leaks, this data was captured directly from victims' own devices while they were actively logged in, which means the credentials are likely current. That makes a stealer log like this one of the more immediately usable sources for an attacker.

What Was Harvested From These Devices

• Email Addresses: identifies whose accounts were captured.
• Plaintext Password: readable and usable right away.
• URLs: shows exactly which site or API host each password belongs to.

Why Infected Devices Expose So Much at Once

Malware running on a device typically scoops up every saved password in the browser, not just one account. That means each infected device behind this log likely handed over several accounts belonging to the same person, from email to work tools to shopping sites. Browser autofill data and saved payment details can be swept up in the same pass, widening the damage well beyond login credentials alone.

How This Kind of Log Gets Collected

Malware quietly installed on a victim's computer gathers saved passwords, session information, and the sites they are tied to, then sends it all back to whoever controls the infection. The result becomes a numbered, dated log like this one, passed along from there.

Cleaning Up After Flores Private Cloud 77

Scan your email to check your exposure. If you are affected, treat the source device as still infected: clean or reimage it before changing anything, then update your passwords from that clean device. Apply the same caution to work accounts as to personal ones if they were used on the infected machine.