Researchers Traced HomeCloud Stealer Log to 1,363 Home User Credentials

HEROIC found 1,363 records on 01-Mar-2023 inside a Telegram stealer log bundle labeled HomeCloud, uploaded by a Telegram user. Researchers traced the dump to cloud-service credentials harvested from home users, exposing email addresses, plaintext passwords, and login URLs.

Why This Stealer Log Is Dangerous

HomeCloud targets exactly the accounts people rarely secure: consumer cloud storage, email, and streaming. HEROIC analysts verified that every credential in the file was plaintext, unhashed, and ready to use. No cracking required, no additional work for the buyer.

What Was Exposed in HomeCloud

• 1,363 unique home-user email and password pairs
• Plaintext passwords with no protective hashing
• Cloud storage and consumer SaaS URLs
• API host entries tied to home-service providers
• Endpoint metadata from infected household devices

Why This Matters

Evidence from the HomeCloud file shows that a single infected family computer can leak credentials for iCloud, Google Drive, OneDrive, Netflix, and banking portals simultaneously. Attackers pivot from one weak consumer password into full identity theft, tax fraud, and SIM-swap attempts on the household.

How a Stealer Log Like HomeCloud Works

Infostealer malware infects a home PC through a pirated app, fake installer, or malicious browser extension. It silently exports saved browser passwords, cookies, and cloud-session tokens, then transmits the package to an operator who tags it with a channel name like HomeCloud and posts it to Telegram for resale and reuse.

Check If You Are Affected

HEROIC indexes more than 400 billion compromised records across breaches, leaks, and stealer log dumps including HomeCloud. Search your email at heroic.com to confirm exposure, rotate reused home-cloud passwords, revoke active sessions, and add multifactor authentication to every consumer account on the household device.