HEROIC Analysts Uncover Second Skycloudcombo Leak of 1,065 Accounts

While reviewing new Telegram uploads, HEROIC analysts flagged a second "Fresh Hotmail skycloudcombo" file, this one dated January 22, 2025, containing 1,065 additional Hotmail logins. It appears to be a follow up batch from the same source, released just days after the first, wich suggests whoever is behind it is harvesting credentials on an ongoing basis rather than as a one-time event.

Why This Is Dangerous

A second wave from the same group is often worse news than the first, because it means the credential harvesting operation is still active. Anyone whose Hotmail account slipped into this file has both a plaintext password and a login URL now sitting in a criminal's hands, and there's a good chance the same malware is still running on infected devices right now, continuing to colect new victims.

What Was Exposed

• 1,065 Hotmail accounts
• Plaintext passwords
• Associated login URLs
• A second dump linked to the same skycloudcombo naming pattern

Why This Matters

Analysts pay close attention when the same source name shows up twice, because it usually points to an active, ongoing operation rather than a single leftover file. Every account in this batch is a household or small business that could loose access to their email with almost no warning.

How Stealer Logs Work

These recurring dumps typically trace back to a single strain of infostealer malware that keeps running on infected machines long after the first infection. Each time the malware phones home, it grabs whatever new passwords have been saved since the last check-in, and operators repackage that fresh batch into a new file to sell or share. That's likely why this second skycloudcombo release exists barely four days after the first one.

Check If You Are Affected

Because this appears to be part of an ongoing leak campaign, checking your email now and checking it again periodically is a smart habit. HEROIC's free scanner covers more than 400 billion breached records and updates as new dumps like this one surface, so you'll know quickly if you show up in this batch or a future one.