Inside the TXT Cloud Leak: How 1,190,856 Logins Got Exposed

Researchers tracking Telegram breach channels flagged something unusual on 15-Nov-2025: a second TXT Cloud stealer log appeared just hours after the first, this one branded 1.3M URL LOG PASS - TXT CLOUD. When the file was parsed, it held 1,190,856 individual credential sets, nearly double its companion release.

Why This Is Dangerous

What makes this one particularly concerning is the shear scale paired with the format. Every record pairs an email, a plaintext password, and the website where that password was typed in, so there's no guesswork involved for whoever picks up the file. Attackers don't need to break any encryption because there isn't any to break.

What Was Exposed

• Email addresses collected from infected devices
• Plaintext passwords with no hashing or encryption
• URLs showing exactly which site each password belongs to

With over 1.19 million entries, this release is large enough that it's likely to overlap with other stealer logs circulating in the same Telegram groups, including its smaller companion file released the same day.

Why This Matters

A leak this size doesn't just affect the original victims, it ripples outward. Anyone who used the same password on more than one account is exposed on every one of those accounts, not just the one the malware happened to catch. It's easy to asume a stealer log is old news by the time it surfaces, but these credentials were current enough to still work when they were harvested.

How Stealer Logs Work

Stealer logs like this one come from infostealer malware, malicious code that hides inside pirated software, cracked mods, or fake downloads. Once installed, it digs through the victim's browser to recieve saved logins, cookies, and autofill entries, then packages everything into a log file. From there it gets uploaded to a server the attacker controls, and often resold or leaked on Telegram channels exactly like the one this file surfaced in.

Check If You Are Affected

With more than 400 billion (400B+) breached and leaked records in HEROIC's database, including stealer logs like this 1.3M URL LOG PASS - TXT CLOUD release, checking your exposure takes less than a minute. Run a free scan, and if your email turns up, update every password you've reused elsewhere right away.