Inside Cloud_Rolex_3: How Malware Harvested 16,558 Passwords

Inside the "Cloud_Rolex_3" Stealer Log: 16,558 Records Exposed

HEROIC analysts identified a stealer log file called "Cloud_Rolex_3" that was uploaded to a Telegram channel on September 2, 2025. The file contained 16,558 records pulled directly from infected devices, including email addresses, plaintext passwords, and the URLs of the accounts those credentials unlock.

Why This Is Dangerous

Because the passwords in this log were captured in plaintext, there is no encryption to break before they can be used. Paired with the matching email address and account URL, an attacker can log straight in, with no guesswork involved.

What Was Exposed

• Email addresses
• Plaintext passwords
• Account and login URLs

Why This Matters

Because these passwords were harvested directly from user devices, they reflect the actual, current passwords people are using, not old or outdated ones. If any of the 16,558 exposed passwords is reused elsewhere, an attacker can use it for credential stuffing against banking, email, or social media accounts, opening the door to identity theft and financial fraud.

How Stealer Logs Work

This data was produced by infostealer malware, a category of malicious software that runs quietly on an infected computer and copies saved browser passwords, autofill entries, and session information before sending it back to the attacker in control. The harvested credentials are then compiled into files like "Cloud_Rolex_3" and shared or sold through channels such as Telegram. Because the malware collects data directly from the device, a single stealer log like this one can affect accounts across many unrelated websites and services.

Check If You Are Affected

HEROIC's free breach scanner checks your email address against a database of more than 400 billion leaked records, including stealer logs like this one. Run a free scan to see if your credentials were exposed and get guidance on securing your accounts.