224,336 LeakBase Zerocloud Credentials: Plaintext Passwords Exposed Dark Web

On November 17, 2024, a threat actor known as "moi geroi" posted a stealer log titled "lp 118 Mb" to a prominent underground forum under the LeakBase zerocloud label. The dataset totalled approximately 1.7 million raw records and contained 224,336 unique email addresses paired with plaintext passwords and homepage URLs. While smaller in volume than many stealer log releases from the same period, the dataset's contents are no less dangerous: every password in the file is stored in plaintext and was captured live from compromised user devices, making the credentials immediately actionable without any decryption step.

Why This Is Dangerous

The zerocloud dataset's primary risk factor is the combination of plaintext passwords and homepage URLs. Plaintext passwords mean zero barrier for attackers: credentials can be loaded directly into automated tools and tested against live accounts within minutes. The homepage URLs provide targeting intelligence, identifying the specific websites from which each set of credentials was stolen. Together, these two data points allow attackers to conduct precise, personalized account takeover attempts with a high probability of success, particularly against users who reuse passwords across multiple services.

What Was Exposed

• Email addresses: 224,336 unique accounts identified in the dataset
• Plaintext passwords: Captured directly from infected devices, no cracking required
• Homepage URLs: Revealing which websites and services were targeted during credential harvesting
• Total raw records: Approximately 1.7 million lines in the source log file
• Log file size: 118 MB
• Date of leak: November 17, 2024
• Platform: LeakBase underground forum

Why This Matters

Even at a smaller scale, stealer log datasets like zerocloud drive serious downstream harms:

• Credential stuffing: Each of the 224,336 email-password pairs can be tested automatically across banking portals, email providers, streaming services, and enterprise SSO systems to find accounts where the password was reused.
• Account takeover: Successful logins give attackers control over an account, enabling password changes, financial transfers, and use of the account as a launchpad for further attacks.
• Identity theft: A compromised primary email account typically unlocks password resets on every linked service, from financial institutions to government ID portals.
• Fraud: Homepage URLs in the log allow attackers to craft personalized phishing messages referencing the exact services a victim is known to use, making social engineering attacks far more convincing.

How Stealer Malware Works

Infostealer malware, the source of datasets like the LeakBase zerocloud log, is designed to run silently on compromised devices and extract saved credentials without the victim's knowledge. Infection vectors include phishing emails with malicious attachments, trojanized software downloads, malicious browser extensions, and drive-by exploit kits. Once active, the malware harvests browser-stored passwords, session cookies, autofill data, and application tokens, bundling everything into structured log files. These files are exfiltrated to attacker servers and then sold or shared on underground forums where additional threat actors acquire them for credential stuffing campaigns, identity fraud, and account resale operations.

Check If You Are Affected

The Heroic Data Breach Search Engine indexes over 400 billion records from thousands of breach events and stealer log datasets, including incidents like the LeakBase zerocloud dump. Searching your email address takes seconds and reveals immediately whether your credentials appear in any known exposure. If they do, you have the information you need to change your passwords, enable multi-factor authentication, and secure your accounts before attackers make their move.

Search your email at Heroic.com now to find out if your credentials are exposed.