Malware Harvested Joomla Logins, 62 Leaked via Nullcyber Cloud

A small file with a long technical name, ULP_Joomla_262_051025_144228_Nullcyber_Cloud, made its way onto Telegram in October 2025. Despite the mouthful of a title, the mechanism behind it is simple, malware or a scraper harvested login pairs tied to Joomla powered sites and packaged up 62 records for anyone to grab.

Why This Is Dangerous

The word ULP in the file name stands for username, login, password combinations, meaning these 62 entries are ready to use exactly as they are. There's no extra step needed for an attacker, no decoding or cracking, just a straight list of working credentials tied to Joomla sites that someone can start testing rite away.

What Was Exposed

• 62 records from the Nullcyber Cloud upload
• Email addresses
• Plaintext passwords
• URLs pointing to the Joomla sites involved

Why This Matters

Joomla powers a lot of small business websites, so a leak like this one, even at just 62 records, could hand an attacker admin access to a handful of sites if any of those logins belong to site administrators rather than regular users. A breach that seams small on paper can definately open the door to a much bigger compromise if the right account is in there.

How Stealer Logs Work

This kind of leak typically starts with malware infecting a device that had saved Joomla admin credentials in its browser, or with an attacker scanning for exposed login pages directly. Either way the result is the same, a text file full of working username and password pairs, labeled with a timestamp and a group name like Nullcyber Cloud before getting shared around.

Check If You Are Affected

Whether or not you run a Joomla site, it's worth checking your email against this leak and others like it. HEROIC's free breach scanner searches more than 400 billion exposed records, giving you a quick way to see if your credentials are part of this 62 record file or a larger one.