Researchers Trace the InerealCloud P4 Log to 1.35 Million Stolen Credentials on BreachForums

HEROIC analysts discovered a stealer log labeled InerealCloud 3.8M ULP P4, posted to BreachForums on March 24, 2025. This dataset, the fourth installment in a series of InerealCloud releases published that same day, contained 1,351,512 unique records. Each record bundled an email address with a plaintext password and a homepage URL, forming a ready-to-use credential package that requires no additional work on the part of any criminal who downloads it.

Why Plaintext Password Exposure Is Immediately Dangerous

Passwords in this dataset were never hashed or encrypted. A criminal who opens the file sees working credentials in the same form you typed them. There is no cracking required, no waiting, and no technical skill needed to begin testing those credentials against email providers, banking apps, and social media platforms. The homepage URLs bundled with each record help attackers identify which services to target first, turning this leak into a prioritized attack list rather than a raw data dump.

What Was Exposed in the InerealCloud P4 Stealer Log

The following data types were confirmed in the leaked dataset:

• Email Address
• Plaintext Password
• Homepage URL

Why This Matters for Victims in the Dataset

When email addresses and working passwords are published together, the consequences extend well beyond the original service where the credential was captured. Credential stuffing tools can test a single stolen login pair against hundreds of websites in minutes. Accounts that share the same password become vulnerable simultaneously. This creates a cascade effect where one exposed credential can lead to account takeovers across banking, shopping, email, and cloud storidge platforms. Identity theft and unauthorized purchases are among the most reported outcomes in cases involving stealer log leaks.

How Stealer Logs Are Created and Distributed

Stealer logs originate from infostealer malware, programs designed to run silently on a victim's computer and harvest saved passwords, browser cookies, and autofill data. The malware typically arrives via phishing emails, fake software downloads, or drive-by infections on compromised websites. Once installed, it collects credentials from the device and sends them to an attacker-controlled server. The attacker aggregates thousands of these harvested sessions into a single log file, which is then packaged and posted to forums like BreachForums, either for sale or as a free release intended to build the poster's reputation in criminal communities. Because the malware captures credentials directly from the browser before they are transmitted, the passwords appear in plaintext regardless of how the target website stores them.

Check If You Are Affected by the InerealCloud P4 Leak

This dataset is one of at least four InerealCloud packages released on March 24, 2025, meaning the total exposure from this campaign is far larger than any single file suggests. HEROIC's free breach scanner checks your email address against more than 400 billion compromised records, drawing from stealer logs, dark web dumps, and confirmed breach datasets. If your credentials appear in any of these files, you will see it immediately and can take steps to secure your accounts before the damage spreads.