The ICELOGSCLOUD Leak Exposed 6,675 U.S. Endpoint Logins

A stealer log titled "05 DECEMBER - 425 PCS ICELOGSCLOUD" was uploaded to a Telegram channel on December 5, 2022, its name implying data pulled from roughly 425 infected computers, with country data on the source records tied to the United States. The name is the uploader's own label, not a confirmed corporate breach. HEROIC's threat intelligence team verified the file's contents: 6,675 records containing email addresses, plaintext passwords, and URLs, the standard output of information-stealing malware.

Why This Is Dangerous

A batch this size, drawn from hundreds of separate infected machines, means the exposed credentials are not concentrated in one place. They are spread across whatever accounts each infected user happened to have saved in their browser, from personal email to shopping and banking sites, all bundled into a single file and shared publicly on Telegram.

What Was Exposed

• Email addresses tied to real accounts
• Plaintext passwords stored with no encryption
• URLs showing exactly which site or service each password unlocks

Why This Matters

Plaintext passwords paired directly with the URL they unlock give an attacker a ready list of working logins with no cracking required. When people reuse the same password across multiple accounts, a single leaked credential can be tested against dozens of other sites through credential stuffing, leading to account takeover, identity theft, and financial fraud.

How a Stealer Log Like ICELOGSCLOUD Gets Built

Infostealer malware spreads through cracked software, malicious attachments, or fake installers. Once it runs on a device, it reads every password saved in the browser along with the site it belongs to, then exports that data as a log. An operator collecting hundreds of these logs, in this case around 425 machines, bundles them into one file and distributes it through Telegram channels like the one this data surfaced on.

Check If You Are Affected

You do not have to have downloaded anything suspicious yourself to be at risk if your credentials show up in a leak like this one. HEROIC's free scanner checks your email against more than 400 billion breached and leaked records, including this ICELOGSCLOUD stealer log, so you can see your exposure and change any reused passwords right away.