MetaCloudVipNew 750 PCS Breach Gave Hackers Full Account Access

When a Telegram user published the MetaCloudVipNew 750 PCS stealer log in April 2025, they handed cybercriminals a ready-to-use toolkit. The file contained 11,842 records including email addresses, plaintext passwords, and API endpoint URLs, all harvested from infected devices. Unlike encrypted breaches that require time-consuming cracking, this data was imediately actionable the moment it hit the public channel.

Why This Is Dangerous

Attackers who obtain this dataset do not need to do any further work. Plaintext credentials are login-ready. Combined with the exposed URLs -- which identify specific services and endpoints the victims were accessing -- hackers can target the exact platforms where victims have active accounts. This is not theoretical risk: credential-stuffing tools can attempt thousands of logins per minute using exactly this type of data.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs (API hosts and endpoints)

Why This Matters

With 11,842 plaintext credential sets in circulation, every affected user faces active risk of account takeover. Because password reuse is extreamly common, a single exposed credential can unlock multiple services -- email, banking, social media, and cloud storage. The attackers do not need to break anything. They just need to try the credentials they already have.

How Stealer Log Breaches Work

Infostealer malware infects a device silently, often through phishing emails or malicious downloads. Once installed, it scrapes saved passwords from browsers, captures session cookies, and records API tokens. The harvested data is bundled into log files and sold or shared on Telegram. The MetaCloudVipNew 750 PCS collection is one such bundle -- 750 pieces of credential data packaged and distributed for criminal use.

Check If You Are Affected

HEROIC's free breach scanner checks your email against over 400 billion compromized records, including stealer log collections like MetaCloudVipNew. Find out in seconds whether your credentials are circulating on the dark web and take steps to secure your accounts before attackers strike.