Inside WHM WRTCloud Stealer Logs: 60 Server Passwords Harvested

HEROIC's threat intelligence systems detected a stealer log labeled "whm_wrtcloud" circulating on Telegram that contains 60 compromised records targeting WebHost Manager (WHM) credentials. WHM provides root-level server management access, making this a high-severity exposure despite the relatively small record count. Each entry includes a plaintext password, email address, and the WHM panel URL.

Root-Level Access in Plaintext

WHM credentials are among the most powerful hosting credentials that can be stolen. They grant administrative control over entire servers, including all cPanel accounts, databases, email systems, and DNS configurations hosted on that machine. The 60 passwords in this dump are in plaintext—unencrypted and immediately usable—making each one a potential master key to a server infrastructure.

What Was Exposed

• Email Addresses – WHM administrator account identifiers
• Plaintext Passwords – Unencrypted root-level server management credentials
• URLs – Direct paths to WHM login panels, typically on port 2087

The Cascading Impact of WHM Compromise

A single compromised WHM credential can affect every website, email account, and database on the server. Attackers with WHM access can create new accounts, modify existing ones, install malicious software, redirect traffic, and exfiltrate customer data. If administrators reuse these passwords elsewhere, credential stuffing attacks compound the damage further across their personal and professional accounts.

How Infostealers Target Server Administrators

The WRTCloud collection specifically curates web infrastructure credentials extracted by infostealer malware. When a server administrator's workstation is compromised by malware like Redline, Vidar, or Stealc, the malware harvests every saved browser password—including WHM, cPanel, Plesk, and SSH credentials. These are then sorted into infrastructure-specific collections and distributed through Telegram and dark web channels, where they command premium prices due to their high-value access.

Check If Your Credentials Were Exposed

HEROIC's free breach scanner indexes over 400 billion compromised records. Server administrators should search their email addresses and domains to determine whether their WHM credentials appear in this wrtcloud dump or other known breaches. If compromised, change WHM passwords immediately, enable two-factor authentication, restrict access to trusted IPs, and audit all hosted accounts for unauthorized changes.