How a Stealer Infection Led to the Cloud_Rolex_2 Leak of 27,157 Logins

How a Stealer Infection Led to the Cloud_Rolex_2 Leak of 27,157 Logins

HEROIC analysts identified a stealer log named "Cloud_Rolex_2" uploaded to a public Telegram channel on July 16, 2025. The file contained 27,157 records, including email addresses, plaintext passwords, and the API host URLs tied to each account, with most exposed users located in the United States.

Why This Is Dangerous

Every password in this log was captured in plaintext, so it works the moment someone downloads the file, with no cracking or guessing required. Pairing plaintext passwords with the API host URL for each account gives an attacker both the credential and the exact address it unlocks, turning a simple list into a ready-made script for breaking into real accounts.

What Was Exposed

• Email addresses
• Plaintext passwords
• API host URLs

Why This Matters

A leak of over 27,000 records gives attackers plenty of raw material for credential stuffing, where stolen email and password pairs are tested automatically across banking sites, email providers, and social media accounts. Anyone who reused one of these 27,157 passwords elsewhere faces a real risk of account takeover, which can quickly escalate into financial fraud or identity theft.

How This Stealer Infection Happened

Logs like Cloud_Rolex_2 start with infostealer malware landing on a single device, usually through a malicious download, a cracked piece of software, or a phishing attachment. Once installed, the malware quietly copies every saved password, cookie, and autofill entry it finds and sends the haul back to whoever controls it. From there, the resulting log is packaged and shared for free or sold on Telegram channels and dark web forums, where anyone can download it and start testing the credentials inside.

Check If You Are Affected

There is no way to know just by looking whether your email address is part of a stealer log like this one. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records and tells you immediately whether your credentials have been exposed. Run a scan now and change any password that comes back compromised.