How Malware Led to 19,029 Stolen Logins in Pegasus Cloud

HEROIC's threat analysts discovered a stealer log dataset labeled "Pegasus Cloud" being shared through Telegram channels, containing 19,029 compromised records. Each entry was silently extracted from an infected device by infostealer malware, capturing plaintext passwords alongside email addresses and the URLs where those credentials were used.

Unencrypted Passwords Leave No Room for Delay

Every password in this Pegasus Cloud dump is stored in plaintext—meaning it is fully readable without any decryption. Attackers do not need specialized cracking tools or computing resources to exploit these credentials. They can simply copy a password and log in, making speed the only defense for affected users.

What Was Exposed

• Email Addresses – Account login names and targets for spear-phishing campaigns
• Plaintext Passwords – Unprotected credentials that are instantly exploitable
• URLs – The websites and services where victims entered their login details

From One Password to Many Compromised Accounts

Credential stuffing is a widespread attack method where stolen login pairs are tested against thousands of websites using automated bots. Since many users rely on the same password for multiple services, a single exposed credential can give attackers access to email inboxes, financial accounts, workplace platforms, and more. The 19,029 records in this leak fuel exactly this kind of cascading attack.

The Malware Pipeline Behind Stealer Logs

Infostealers like Redline, Aurora, and Raccoon operate quietly in the background after infecting a device. They siphon saved browser passwords, active session cookies, cryptocurrency wallet data, and form autofill entries. This stolen data is compiled into structured log files—each one representing a compromised individual—and then distributed on Telegram groups and underground forums for profit.

Check If Your Credentials Were Exposed

With over 400 billion compromised records indexed, HEROIC's free breach scanner can tell you whether your email or domain appears in this Pegasus Cloud dump or any other known breach. Search now to identify compromised credentials and take immediate steps to secure your accounts before attackers get there first.