GHOST CLOUD FREE 2 Breach: 774 Passwords Leaked Online

774 stolen logins might sound small next to breaches that hit the millions, but it is roughly the size of a packed high school, every single person handing over their email and password at once. That is what HEROIC analysts found in a stealer log called GHOST CLOUD FREE 2, uploaded to a Telegram channel in October 2025. Each record includes a plaintext password, an email address, and the exact URL where the login was captured.

Why This Is Dangerous

Smaller logs like this one are often more dangerous per record than massive dumps, because the credentials were harvested recently and tend to still work. An attacker does not need to sift through outdated data. They can move straight from download to login, testing each of these 774 combinations against the real sites listed in the file.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs tied to each login

Why This Matters

Even a few hundred fresh credentials give attackers plenty to work with. These records get folded into credential stuffing campaigns, where the same email and password combo is tested across banking sites, email providers, and shopping accounts. Because password reuse is so widespread, one exposed login from this file can snowball into account takeover, identity theft, and financial fraud.

How Stealer Logs Work

Stealer malware sneaks onto a device through a fake download or cracked software, then quietly extracts saved passwords, autofill entries, and session data from the browser. The results are compiled into a log file and branded with a name, in this case GHOST CLOUD FREE 2, before being distributed on Telegram to buyers looking for ready-to-use credentials.

Check If You Are Affected

A few hundred records can still mean your data is exposed. HEROIC's free breach scanner checks your email against a database of more than 400 billion compromised records, so you can find out quickly and change any passwords that are still at risk.