Inside the TXT Cloud Log: How Malware Harvested 20,264 Passwords

HEROIC analysts found a stealer log file uploaded to a Telegram channel on October 29, 2025, labeled "TXT Cloud - LOGS_900PCS." The file contained 20,264 records pulled directly from infected devices, each one pairing an email address with a plaintext password and a URL pointing to the login page it unlocks. This was not a breach of a single company's servers but a collection of credentials harvested from individual users' own machines.

Why This Is Dangerous

Because the passwords in this log are stored in plaintext, an attacker does not need to crack or guess anything. They can pull an email and password pair directly from the file, open the matching URL, and log in immediately as the account owner. That makes this data far more dangerous in the short term than a breach involving hashed or encrypted passwords.

What Was Exposed in the TXT Cloud Stealer Log

• Email addresses
• Plaintext passwords
• URLs of the associated login pages

Why This Matters

Credentials like these fuel credential stuffing attacks, where attackers automatically test stolen email and password pairs against banking sites, email providers, and social media platforms. Anyone among the 20,264 people in this log who reused a password on another account faces a real risk of account takeover, identity theft, and financial fraud.

How Malware Harvested the TXT Cloud Stealer Log

A stealer log is the direct output of infostealer malware, which typically infects a device through a fake download, cracked software, or a phishing link. Once running, the malware quietly copies saved browser passwords and autofill data straight off the victim's machine and bundles everything into a single file. That file is then shared or sold on platforms like Telegram, exactly where this TXT Cloud log surfaced, letting anyone who obtains it use the credentials directly without ever needing to breach the services named inside.

Check If You Are Affected

If your email address might be part of the TXT Cloud stealer log or another breach circulating on the dark web, HEROIC's free breach scanner checks it against a database of more than 400 billion leaked records. Run a free scan today, and if your credentials turn up, change the affected passwords right away and stop reusing them across sites.