MetaCloudVipNew LINE Leak Exposes 72,350 US User Accounts

A file named MetaCloudVipNew 343 K LINE surfaced on Telegram on 04-Oct-2025, and inside it sat 72,350 records tied mostly to accounts based in the United States. HEROIC's analysts flagged it fast, since a batch this large usually means a single piece of malware spread across a huge number of infected machines.

Why This Is Dangerous

When a leak is this concentrated in one country, it tends to travel through local networks quickly, shared computers at schools, family laptops, workplace machines that were never properly secured. Each of the 72,350 entries represents a person who typed their email and password into a browser that was, without their knowledge, forwarding every keystroke to a seperate server controlled by an attacker.

What Was Exposed

• 72,350 individual records
• Email Addresses
• Plaintext Password
• URLs linked to each login

Why This Matters

For US-based users specifically, this kind of leak often lines up with tax season phishing, fake delivery texts, and other scams that rely on knowing a real email and password. Attackers don't need to break into anything, they just log in like the real user would. If you don't act, thier information keeps circulating on Telegram channels indefinitely.

How This Stealer Log Works

Info-stealing malware gets installed through pirated software, cracked apps, or a fake browser update, then it imediately starts harvesting saved logins, cookies, and autofill fields from the infected machine. Everything gets bundled into one file and pushed out through Telegram channels like the one this file came from, often within hours of infection.

Check If You Are Affected

Rather than guessing, run your email through HEROIC's free breach scanner. It checks against a database of more than 400 billion leaked records, including this exact stealer log, so you know right away if your login needs to be changed.