MetaCloudVipNew Leak: 2.73 Million Passwords Exposed

HEROIC analysts observed a stealer log named "MetaCloudVipNew" surface on Telegram on December 15, 2025, carrying 2,734,321 records taken from infected devices. Researchers tracking the channel noted the file contained email addresses, plaintext passwords, and the login URLs tied to each account.

Why This Is Dangerous

Watching how these logs move through Telegram groups, analysts see the same pattern every time: malware quietly grabs saved logins off a victim's device, then those logins get packaged and shared before the victim ever notices anything wrong. At nearly 2.7 million records, this file gives anyone who downloads it a massive, ready-to-use list of accounts, each one labeled with exactly where it works.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated login URLs

Why This Matters

From the outside, a file like this looks like a spreadsheet. To an attacker, it is a shortcut past every normal security step. Automated tools can run through millions of these pairs in bulk, triggering credential stuffing and account takeover across banking, email, and shopping platforms, often ending in identity theft or financial fraud for the people whose data was taken.

How Stealer Log Breaches Happen

Analysts who study these leaks consistently trace them back to info-stealer malware hidden in cracked software, fake downloads, or phishing links. Once a device is infected, the malware silently collects saved browser passwords, autofill data, and session cookies, then bundles it all into a log sent back to the attacker. Those logs are then circulated on Telegram and dark web forums, exactly the pattern seen with this 2.7 million record file.

Check If You Are Affected

Anyone who reuses saved passwords across sites should treat a leak this size seriously. HEROIC's free breach scanner checks your email against a database of more then 400 billion compromised records, giving you a fast way to see if your information turned up in this or any other breach.