Hosting Admins Targeted: Plesk WRTCloud Exposes Passwords

HEROIC's threat monitoring identified a stealer log labeled "plesk_wrtcloud" on Telegram that exposes 16 compromised records specifically targeting Plesk hosting control panel credentials. While small in volume, this dataset is high in impact—each record represents a potential gateway to an entire web hosting environment, with plaintext passwords paired with admin email addresses and Plesk panel URLs.

Why Plaintext Admin Passwords Are Especially Dangerous

Plesk panel credentials grant administrative access to web servers, databases, email accounts, and hosted websites. When these passwords are exposed in plaintext—fully readable with no encryption—attackers can immediately log into hosting panels and take control of every resource managed through them. Even 16 compromised Plesk accounts could affect hundreds of hosted websites and services.

What Was Exposed

• Email Addresses – Administrative login identifiers for Plesk hosting panels
• Plaintext Passwords – Unencrypted credentials granting server-level access
• URLs – Direct paths to Plesk control panel login pages

From Stolen Credentials to Server Compromise

Unlike consumer account breaches, compromised hosting panel credentials open the door to far more than one account. Attackers with Plesk access can deploy malware on hosted websites, intercept email communications, modify DNS settings, exfiltrate databases, and create backdoor accounts. Credential stuffing is also a concern if admins reuse their Plesk passwords on other services.

Infostealers Targeting Web Administrators

This collection is part of the broader WRTCloud stealer log series, which focuses on web infrastructure credentials. Infostealer malware like Redline and Vidar does not discriminate—it harvests every saved password from a victim's browser. When a web hosting administrator's device is infected, the malware captures Plesk, cPanel, WHM, and other hosting panel credentials, which are then curated into targeted collections like this one.

Check If Your Credentials Were Exposed

HEROIC's free breach scanner covers over 400 billion compromised records. If you administer Plesk hosting panels, search your email address or domain to check whether your credentials appeared in this wrtcloud dump or any other known breach. Securing hosting panel access is critical—change passwords, enforce two-factor authentication, and restrict panel access to trusted IP addresses.