MetaCloudVipNew: 322K Credentials Leaked, Passwords Plain

What Occured

On December 12, 2025, threat actors dumped 322,761 compromized records via a MetaCloudVipNew stealer log uploaded to Telegram. The breach contained plaintext passwords, email addresses, and system configuration details from a large-scale malware infection targeting cloud platform users.

The Immediate Threat

With 322K plaintext passwords available, attackers now have direct entry to hundreds of thousands of accounts. Email combined with passwords enables immediate account hijacking without any brute forcing or decryption. The size of this dump makes it a valuable resource for criminal marketplaces.

Exposed Records Include

• 322,761 plaintext passwords (human-readable text)
• Email addresses correlated with each password
• Cloud endpoint URLs and service information
• API keys and authentication tokens

Why This Data Breach Matters

Cloud platform compromise is particularly dangerous becauseattackers gain access to stored files, backups, and sensitive data. The MetaCloudVipNew malware appears to specialize in harvesting credentials from users accessing cloud services. This represents a systemic threat to enterprise users relying on cloud infrastructure.

The Stealer Malware Mechanism

These trojans intercept credentials at the browser level, capturing login details as they're entered or retrieved from autofill. They also extract cached session tokens and saved credentials from system storage. The malware sends all harvested data to command servers where operators compile it into saleable logs.

Immediate Actions Required

If your email appears in this MetaCloudVipNew dump, change your cloud platform passwords immidiately. Review your cloud account activity for unauthorized access. Disable any forgotten sessions and regenerate API keys. Run full system scans for trojan malware and consider isolating the affected machine from your network.