The LOGSYNC SunCloudNew Leak of 35,736 Logins Could Unlock Your Bank

HEROIC analysts identified a stealer log tied to a source labeled LOGSYNC SunCloudNew uploaded to a public Telegram channel on May 28, 2025. The file exposed 35,736 compromised records from devices in the United States, including email addresses, plaintext passwords, and the URLs of the login pages the credentials belonged to.

Why This Is Dangerous

Because every password in this log was captured and stored in plaintext, there is no encryption standing in an attacker's way. Each of the 35,736 records pairs a working email address with its exact password and the site it unlocks, whether that is an email provider, a bank, or a social media account. If the same password was used across multiple sites, one leaked credential can unlock all of them at once.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the associated login pages

Why This Matters

A leak of this size feeds directly into credential stuffing, where stolen email and password pairs are automatically tested against banking sites, email providers, and social media platforms until one of them works. Because password reuse is common, gaining access to just one account from this log can be enough to chain into several more, opening the door to account takeover, identity theft, and financial fraud well beyond the original site the credentials were stolen from.

How This Stealer Log Was Created

Logs like this one, tracked here as LOGSYNC SunCloudNew, come from information-stealing malware that infects a device through a cracked application, pirated download, or malicious link. Once active, the malware pulls saved usernames and passwords directly out of the browser, along with the exact URL of every site those credentials belong to, and packages it all into a single file. That file is then shared on Telegram, where anyone in the channel can download it.

Check If You Are Affected

Stealer logs like this one are especially dangerous because the credentials inside are current and unencrypted. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including stealer logs like this LOGSYNC SunCloudNew upload, so you can find out quickly whether your information was part of this exposure.