Inside the Pegasus Cloud Logs: How Malware Harvested 23,465 Passwords

HEROIC analysts identified a stealer log labeled "Pegasus Cloud TG PegasusCloud" circulating on a Telegram channel in July 2026. The file contained 23,465 records of stolen endpoints, email addresses, API hosts, and plaintext passwords, the kind of data infostealer malware pulls directly from an infected device.

Inside the Pegasus Cloud Logs: How Malware Harvested 23,465 Passwords

Stealer logs like this one come from infostealer malware quietly running on a victim's computer, copying saved browser passwords, autofill entries, and session data before sending it all back to whoever controls the malware. The 23,465 records in the Pegasus Cloud file were captured this way, meaning every email, password, and endpoint listed was working and saved on a real device at the moment it was stolen. There is no cracking involved, an attacker simply reads the log.

What Was Exposed

• Email addresses
• Plaintext passwords
• Login URLs and endpoints tied to each stolen credential

Why This Matters

Because a stealer log captures whatever was saved on the device at the time of infection, one log can expose logins for email, social media, and financial accounts all at once. Anyone whose credentials appear in this file faces a real risk that a reused password gets tried on other accounts, and access to a saved email login in particular gives an attacker the ability to reset passwords on nearly everything else tied to that inbox.

How Stealer Logs Like This One Are Built

Infostealer malware typically infects a device through a phishing email, a cracked software download, or a malicious ad, then quietly copies saved credentials and session details before sending everything back to the attacker. The result is packaged into a "log," named and shared in bulk on Telegram, often alongside logs from thousands of other infected machines. A log's small size does not make it less dangerous, every entry is a real, working credential captured from a live device.

Check If You Are Affected

You do not have to guess whether your information is sitting in a dump like this one. HEROIC's free breach scanner checks your email address against more than 400 billion leaked records pulled from combolists, stealer logs, and dark web marketplaces. Run a free scan, and if a match turns up, change that password everywhere else you have used it.