MetaCloudVipNew Breach: 65,620 Passwords Found on Dark Web

HEROIC's dark web monitoring team traced a stealer log named "MetaCloudVipNew" circulating on Telegram since October 28, 2025. The log, described by its uploader as containing 346,000 lines, breaks down to 65,620 usable records of email addresses, plaintext passwords, and the URLs those credentials unlock.

Why MetaCloudVipNew Is a Dark Web Intelligence Concern

What makes this log noteworthy is not just its size but its branding. Sellers on Telegram often package stealer logs under catchy names like "MetaCloudVipNew" to market them as premium or high value goods to other criminals. That kind of packaging usually signals the data has already been screened for accounts worth targeting, such as ones with financial or cloud service access.

Our analysts flag these branded logs because they tend to move faster through dark web channels than generic dumps, meaning affected users have less time to react before their credentials are tested.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated login URLs

Why This Matters

Every credential in a log like this is a potential key to more than one account. Attackers feed stolen email and password pairs into credential stuffing scripts that test them against banks, retailers, and social media in bulk, hunting for reused passwords.

When a match hits, the result can be an emptied bank account, a hijacked social profile, or a stolen identity used to apply for loans in the victim's name.

How Stealer Log Breaches Work

Stealer malware typically rides in through pirated software, fake browser updates, or phishing links. Once active on a device, it pulls saved passwords and autofill data straight from the browser, then compiles the haul into a text log within moments.

From there, the log gets rebranded, bundled, and sold or shared on Telegram channels exactly like the one behind MetaCloudVipNew, often changing hands multiple times before the victim ever notices anything is wrong.

Check If You Are Affected

Branded logs like this one move quickly through dark web marketplaces, so speed matters. HEROIC's free breach scanner checks your email against a database of over 400 billion compromised records, giving you a clear answer in seconds so you can lock down your accounts before criminals do.