HEROIC Analysts Flag IckisCloud Stealer Leak of 21,612 Records

HEROIC analysts identified a stealer log file labeled Ickis Arhive IckisCloud circulating on a Telegram channel used to trade malware-harvested credentials. The file was first logged on August 6, 2025 and contains 21,612 records, each pairing an email address with a plaintext password and an associated URL.

Why This Is Dangerous

This data was pulled directly from infected devices by information-stealing malware, meaning the passwords were captured in plaintext exactly as each victim typed them. Every record also ties a password to the exact website it unlocks, so an attacker can attempt that login immediately without guessing or cracking anything. Because people frequently reuse passwords, one leaked credential often opens the door to other accounts belonging to the same person.

What Was Exposed

• 21,612 total records
• Email addresses
• Plaintext passwords
• URLs tied to each set of credentials
• Data first appeared in circulation on August 6, 2025

Why This Matters

A plaintext credential dump of this size is immediately usable by attackers. It can be run through credential stuffing tools that test the same email and password combination across banking sites, email providers, and online retailers, which leads to account takeover, identity theft, or financial fraud for anyone who reused that password elsewhere.

How Stealer Logs Work

A stealer log is produced by malware that infects a victim's device, often through a fake download, pirated software, or a malicious email attachment. Once installed, it quietly collects saved browser passwords, autofill data, and the web addresses tied to each login, then packages the results into a file that gets labeled and shared. Files like this one are routinely posted to Telegram channels and dark web forums, where other criminals collect and combine them with data from other leaks to build larger attack lists.

Check If You Are Affected

Because this data came from a stealer log rather than a breach at a single company, there is no company that will notify affected users directly. HEROIC's free breach scanner checks your email against more than 400 billion leaked records, including stealer logs like this one, so you can quickly find out if your credentials were exposed and change any reused passwords before someone else does.