HEROIC Researchers Link KATANA_CLOUD to 15,839 Stolen Credentials

KATANA_CLOUD Stealer Log Exposes 15,839 Records

HEROIC analysts identified a stealer log tied to a "KATANA_CLOUD 35 DISCOUNTS" upload, appearing on Telegram on June 12, 2025. The file exposed 15,839 records tied to United States users, including email addresses, plaintext passwords, and the URLs of the accounts those credentials unlock.

Why This Is Dangerous

Because the passwords in this log were captured in plaintext, an attacker can log in immediately without cracking or guessing anything. Each credential is paired with the URL of the account it belongs to, giving anyone who obtains the log a direct, ready-to-use list of targets.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated account and API URLs

Why This Matters

Logs advertised with names like "35 discounts" suggest the seller is actively marketing access to more stolen data, meaning this is unlikely to be an isolated incident. Because so many people reuse the same password across multiple accounts, a single leaked email and password pair can lead to credential stuffing, account takeover, and identity theft on services that have nothing to do with the original compromise.

How Stealer Logs Work

A stealer log is generated by malware that infects a device and quietly copies the passwords, autofill data, and browsing details saved in the browser. The stolen data is sent back to whoever controls the malware, who packages it into a log file and distributes or sells it, often through Telegram channels dedicated to trading stolen credentials. Because the information comes directly from the victim's browser, it tends to be accurate and usable at the time it is stolen.

Check If You Are Affected

If you think your email address or a password you use may be part of this or another exposed dataset, HEROIC's free breach scanner checks your information against a database of more than 400 billion leaked records. Run a free scan now and change any reused passwords right away.