How Infostealer Malware Led to the KATANA_CLOUD Leak of 30,652 Logins

HEROIC analysts identified a stealer log file, labeled KATANA_CLOUD FREE, uploaded by an anonymous user to a public Telegram channel on August 8, 2025. The file contains 30,652 records, each pairing an email address with a plaintext password and the URL of the site or API endpoint the credential was used on. This data was harvested directly from infected devices rather than stolen from a single company's database.

How Infostealer Malware Led to This Leak

Stealer logs like this one start with infostealer malware quietly infecting a device, usually through a malicious download, cracked software, or a phishing link. Once running, the malware reads through the browser's saved logins, autofill entries, and session data, then writes everything it finds into a log file organized by the site each credential belongs to. That process is what produced the 30,652 records in this file before it was uploaded to Telegram.

What Was Exposed in the KATANA_CLOUD Stealer Log

• Email addresses
• Plaintext passwords
• Associated login URLs

Why This Is Dangerous

Because these passwords were captured in plaintext straight from an infected computer, there is no hash to crack and no encryption to strip away. Each record also lists the exact URL the login belongs to, telling an attacker precisely which account to target rather than leaving them to guess, which makes this dataset especially efficient for account takeover.

Why This Matters

Because each password is matched to the exact site it unlocks, attackers can move directly into banking portals, email accounts, or work systems without any trial and error. That precision raises the risk of identity theft, financial fraud, and account takeover for anyone whose credentials appear among these 30,652 records.

Check If You Are Affected

Because stealer log data comes from infected devices rather than a single named website, you do not need to recognize this incident by name to be at risk. HEROIC's free breach scanner checks your email address against a database of more than 400 billion leaked records, including this one, so you can find out what has been exposed and secure your accounts before someone else uses this data against you.