HEROIC Analysts Uncover PixelCloud2 Leak of 147,032 Records

While monitoring Telegram channels known for trading stolen credentials, HEROIC analysts flagged a new upload labeled PixelCloud2, dated March 23, 2026. A closer look showed the file held 147,032 records, another entry in what appears to be an ongoing series of stealer logs coming from the same source.

Why This Is Dangerous

This is the second PixelCloud2 file discovered in a matter of days, wich suggests whoever runs the operation is imediately uploading fresh batches as soon as new devices get infected. With 147,032 plaintext logins in this single upload, the scale of active infections behind it is significant.

What Was Exposed

The PixelCloud2 file from March 23, 2026 contains:

• Email addresses
• Plaintext passwords
• URLs tied to each account

147,032 records is enough for a serious credential stuffing operation to run against major websites for days.

Why This Matters

Some people beleive that discovery by researchers means a leak has been neutralized, but that is rarely true. Once a file like this circulates on Telegram, copies spread to other channels almost instantly, and there is no way to pull it back or guarantee every copy gets deleted.

How Stealer Logs Work

PixelCloud2 fits the standard stealer log pattern: malware infects a device, quietly copies saved browser credentials, and reports back to whoever controls the operation. What makes this case notable is the pace, with a new numbered batch appearing roughly every week, each one larger than expected for such a short gap between uploads.

Check If You Are Affected

HEROIC's analysts caught this one, and HEROIC's free breach scanner can check whether you were caught in it too. Search your email against more than 400 billion leaked records to see if your credentials appear in PixelCloud2 or any related leak.