How a Telegram Upload Led to 1.2 Million Stolen Cloud Logins

HEROIC analysts discovered the 1.3M URL LOG PASS - TXT CLOUD dataset in October 2025, when an anonymous Telegram user uploaded the stealer log file to a private channel. The dataset exposed 1,217,751 records containing email addresses, plaintext passwords, and URLs -- all harvested directly from infected devices using information-stealing malware before being compiled and distributed. This is how modern credential theft works: malware silently drains your browser's saved logins, then packages everything into a file that circulates on Telegram and dark web forums.

Why This Is Dangerous

The TXT CLOUD stealer log is especially alarming because every password in the dataset is in plaintext. There is no hashing to crack, no delay before exploitation -- attackers can take each email and password pair and begin testing it against live websites the moment they download the file. The URLs included in the dataset act as a roadmap, telling attackers exactly which services each victim was using at the time of infection. Cloud storage platforms, email providers, banking apps -- all mapped out and ready to be targeted.

Data Stolen in the 1.3M TXT CLOUD Stealer Log

• Email Addresses -- primary identifier used to attempt logins across all services the victim has accounts with
• Plaintext Passwords -- no decryption required, usable immediately against any site where the password was reused
• URLs -- a full list of the websites and services the victim's browser had saved credentails for at infection time

What Attackers Do With Stolen Stealer Log Data

• Credential stuffing: Automated bots test each email and password pair across hundreds of sites simultaneously, exploiting password reuse
• Account takeover: Successful logins are immediately used to lock out the real owner by changing passwords and recovery details
• Identity theft: Access to email accounts allows attackers to impersonate victims and reset passwords on financial and social accounts
• Financial fraud: Cloud storage, payroll, and banking portals identified in the URL data are prioritzed for immediate exploitation

How Information Stealers Harvest Credentials from Cloud Users

Information stealer malware reaches victims through phishing attachments, trojanized software downloads, and malicious browser extensions. Once installed, the malware targets the browser credential store -- the encrypted database where Chrome, Firefox, and Edge save your usernames and passwords. Stealers decrypt this database locally (using the Windows DPAPI key, which the malware can access on an infected machine) and extract every saved login. Cloud service URLs are particularly valuable targets because they often provide access to sensitive files, business data, and connected third-party applications. The extracted data is then formatted into a ULP (URL-Login-Password) text file and exfiltrated to the attacker's command-and-control server, eventually ending up in Telegram channels like the one where this 1.3M record dataset originaly appeared.

Check If Your Credentials Were Stolen -- Free Breach Scanner

HEROIC's free breach scanner covers over 400 billion compromised records, including stealer log compilations like the 1.3M URL LOG PASS TXT CLOUD dataset. Enter your email address to find out if your credentials are circulating in hacker channels right now. If you appear in this breach, change your passwords immediately on every affected service, prioritize your email account first, and enable two-factor authentication to block access even if a password has been stolen.