KATANA_CLOUD PRIVATE 3604 Leaked 333 Plaintext Passwords

HEROIC analysts found a stealer log named KATANA_CLOUD PRIVATE 3604, uploaded to Telegram in August 2026, holding 333 records of email addresses, plaintext passwords, and the web addresses each login belongs to. The data came straight from infected devices. Scan your email to see if you are one of the 333.

A Small File, Fully Usable

333 records will not make headlines, but every entry works the same way a much larger file would. Each row pairs a real email address with a password that needs no decoding. Size has nothing to do with whether a login still opens the door it was meant for.

What's Inside KATANA_CLOUD PRIVATE 3604

• Email Addresses: identifies a real inbox an attacker can target directly.
• Plaintext Password: fully readable, so it can be used to log in immediately.
• URLs: shows exactly which site or service each stolen login was saved for.

What a Working Password Can Cost You

A password that still works opens the door to more than one problem. It can mean a hijacked email account, unexpected charges, or messages sent to your contacts that did not come from you. None of that requires a large file, just one login that still works.

Where a File Like This Comes From

Stealer malware infects a device through a fake download or a malicious attachment, then quietly copies every saved login it finds. Operators bundle the results into a file like KATANA_CLOUD PRIVATE 3604 before sharing or selling it. No company's systems were touched to create it.

Find Out if Your Login Is Among the 333

Scan your email to check this file for your address. If it turns up, run a security scan on any device you think is infected, then change your passwords from a separate, clean device. This applies equally to a personal inbox and a work email address.