The KATANA_CLOUD Leak: 25,261 Stolen Credentials Hit the Dark Web

KATANA_CLOUD Stealer Log Exposes 25,261 Records

HEROIC analysts identified a stealer log distributed through a Telegram channel, uploaded on June 26, 2025 under the label "1500 SUBS KATANA_CLOUD FREE." The file exposed 25,261 records tied to United States users, including email addresses, plaintext passwords, and the URLs of the accounts those credentials unlock.

Why This Is Dangerous

Because the passwords in this log are stored in plaintext, an attacker can log in immediately, with no cracking or guessing required. Each credential is paired with the URL of the account it belongs to, giving anyone who obtains the log a direct, ready-to-use list of live targets across thousands of accounts.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated account and API URLs

Why This Matters

A log of this size, shared through a Telegram channel with over a thousand subscribers, can spread quickly once it starts circulating. Because so many people reuse the same password across multiple sites, a single leaked email and password pair opens the door to credential stuffing, account takeover, and identity theft on services that have nothing to do with the original compromise.

How Stealer Logs Work

A stealer log is generated by malware that infects a device and quietly copies the passwords, autofill data, and browsing details saved in the browser. The stolen data is sent back to whoever controls the malware, who compiles it into a log file like this one and distributes it, often for free to build a following on channels like this before charging for future logs. Because the information comes straight from the victim's browser, it tends to be accurate and immediately usable.

Check If You Are Affected

If you think your email address or a password you use may be part of this or another exposed dataset, HEROIC's free breach scanner checks your information against a database of more than 400 billion leaked records. Run a free scan now and change any reused passwords right away.