The MetaCloudVipNew Dump Put 7,242 Cloud Logins on the Dark Web

HEROIC analysts found a stealer log file, labeled MetaCloudVipNew 400 PC, uploaded to a public Telegram channel on November 9, 2025. The file contained 7,242 records pulled from infected devices, including email addresses, plaintext passwords, and the API host URLs those credentials connect to.

Why This Cloud Login Dump Is Dangerous

Every credential in this file is stored in plaintext and paired with the exact API host it unlocks, which means an attacker can log straight into a cloud account without cracking a password or guessing where it works. That combination turns a simple file download into a ready-made list for breaking into cloud-connected accounts.

What Was Exposed in the MetaCloudVipNew Log

• Email addresses
• Plaintext passwords
• API host URLs for the connected cloud services

Why This Matters for the 7,242 Accounts Involved

Credentials tied to specific cloud API hosts are especially valuable to attackers, since a single login can open the door to stored files and connected applications, not just one account. Anyone whose email and password appear in this log faces a real risk of account takeover, and if that password was reused elsewhere, the exposure can lead to identity theft and financial fraud on other accounts too.

How a Stealer Log Like MetaCloudVipNew Gets Built

Stealer logs come from infostealer malware that infects a device, typically through a phishing email or a malicious download, and then quietly copies saved browser passwords, autofill data, and the web addresses tied to them. The malware bundles everything into a single log file and sends it back to whoever operates it. Here, that operator uploaded the finished log directly to a Telegram channel, giving anyone in that channel immediate access to all 7,242 records.

Check If Your Login Was in the MetaCloudVipNew Leak

If you use cloud services and are unsure whether your credentials showed up in a leak like this one, it is worth checking now. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including stealer logs like MetaCloudVipNew, so you know right away if a password needs to change.