HEROIC Analysts Discover Second SkyCloudCombo Leak of 3,238

HEROIC analysts discovered a second wave of the Fresh Hotmail skycloudcombo dump circulating on Telegram, this one uploaded in January 2025 and containing 3,238 exposed login records, separate from an earlier batch tied to the same combo name.

Why This Is Dangerous

Finding a second file under a familiar name is its own warning sign, it usually means the same malware operation is still active and still producing fresh victims. The 3,238 records inside are plaintext, meaning every password is instantly usable without any cracking or decoding.

What Was Exposed

• Hotmail email addresses tied to real accounts
• Plaintext passwords stored without encryption
• URLs matching each password to its login page
• 3,238 total records in this second skycloudcombo batch

Why This Matters

When researchers keep spotting new dumps from the same source, it tells you the underlying infection is ongoing, not a one time event. Anyone caught up in the first wave who changed their password could definately still be exposed again if their device is still infected.

How Stealer Logs Work

Repeated dumps like this happen because infostealer malware doesn't stop working after one theft, it sits on the infected device and keeps collecting new logins as the victim uses their browser. Each new batch of stolen data gets exported, packaged, and uploaded seperately, which is exactly why HEROIC's analysts keep finding new versions of the same combo.

Check If You Are Affected

Since this is the second time this combo name has surfaced, it's worth checking again even if you looked before. HEROIC's free breach scanner searches over 400 billion compromised records, so you can confirm your current exposure in seconds.