The KATANA_CLOUD Stealer Log Quietly Surfaced With 21,088 Passwords

KATANA_CLOUD Stealer Log Exposes 21,088 Records

HEROIC analysts identified a second stealer log tied to the "KATANA_CLOUD FREE" upload, this one surfacing on Telegram on July 17, 2025. The file exposed 21,088 records belonging to United States users, including email addresses, plaintext passwords, and the URLs of the accounts those credentials unlock.

Why This Is Dangerous

Plaintext passwords mean an attacker does not need to crack or guess anything to log in as the victim. Combined with the URL each password belongs to, the log functions as a ready-made list of accounts an attacker can target immediately, without any additional research.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated account and API URLs

Why This Matters

Stealer log data like this quietly circulates on platforms such as Telegram long before most victims ever learn their credentials were exposed. Because many people reuse the same password on multiple sites, a single leaked email and password pair can open the door to credential stuffing, account takeover, and financial fraud well beyond the original compromised service.

How Stealer Logs Work

A stealer log is generated by malware that infects a device and silently collects the usernames, passwords, and browsing activity saved in the browser. The stolen data is sent back to whoever controls the malware, who then compiles it into a log file and distributes it, often for free or for sale, through Telegram channels dedicated to trading stolen credentials. Because the information comes directly from the victim's own browser, it is typically accurate at the moment of theft.

Check If You Are Affected

If you think your email address or a password you use may appear in this or another leaked dataset, HEROIC's free breach scanner checks your details against a database of more than 400 billion exposed records. Run a free scan now and update any passwords you have reused elsewhere.