HEROIC Confirms the 35,472-Record metacloudvip Data Breach

metacloudvip: 35,472 US Credentials From the Oct 22, 2023 Telegram VIP Stealer Dump

Among the five stealer log batches released on October 22, 2023, "metacloudvip" carries a distinction the others lack: a VIP designation embedded directly in the channel name. The lowercase, no-spaces format -- "metacloudvip" rather than "Meta Cloud VIP" or "MetaCloud VIP" -- is characteristick of Telegram channel handles, where the operator has branded their credential offering as premium-tier. The batch itself: 35,472 US credential records, email addresses, plaintext passwords, and URLs, released alongside Monster Cloud Free 1 and 2, Fire Cloud Free 1 and 3. Whether the VIP label reflects the quality of the underlying endpoints or is simply a branding decision is unclear -- but the data's impact on victims is identical regardless of tier.

metacloudvip (October 2023): Stealer Log Summary

• Records Exposed: 35,472
• Data Types: Email addresses, plaintext passwords, URLs
• Breach Type: Stealer log -- credentials harvested from malware-infected endpoints, not a direct database breach
• Password Type: Plaintext -- captured directly from browser sessions and credential stores by infostealer malware
• Country: United States
• Date Leaked: October 22, 2023

"VIP" in the Breach Ecosystem: Branding Versus Quality

In the credential distribution market, "VIP" typically signals one of two things: either the underlying endpoints are considered high-value (multi-service users, credential-dense machines) or the operator is simply charging a premium for access to what is essentially the same pool of stealer log output. The metacloudvip channel's participation in a coordinated "Free" dump alongside Monster Cloud and Fire Cloud suggests the latter is at least partially true -- the Oct 22, 2023 release appears to be a multi-operator or multi-channel coordination event, with VIP branding used alongside Free-tier branding in the same release window. For threat actors monitoring these channels, the implication is that more valuable paid tiers may exist behind the public dump.

Oct 22, 2023: Five Batches, One Day, One Operation

The metacloudvip batch arrived the same day as Monster Cloud Free 1 (51,372 records), Monster Cloud Free 2 (41,577 records), Fire Cloud Free 1 (16,712 records), and Fire Cloud Free 3 (39,125 records). Combined, these five batches exposed over 183,000 US credentials from malware-infected consumer endpoints in a single coordinated Telegram release event. The simultanious timing points to a shared distribution infrastructure or closely affiliated operator group executing a planned visibility campaign. For anyone whose credentials appeared in any of these five batches, the exposure date is October 22, 2023 -- and those credentials have been circulating in the breach ecosystem for over a year since.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion exposed records -- including metacloudvip and all five batches from the Oct 22, 2023 Telegram dump. A scan at HEROIC's breach scanner will tell you immediately if your credentials have been in circulation since October 2023.