MetaCloudVipNew: 19,148 Plaintext Passwords Exposed. Check Yours.

In July 2025, a Telegram user uploaded a stealer log file labeled MetaCloudVipNew containing 19,148 compromised records. HEROIC analysts reviewed the dataset and confirmed it includes email addresses, plaintext passwords, and the URLs of services where those credentials were captured. The log is now circulatig across dark web and grey-market channels, making it accessible to a wide range of threat actors who can act on it immediately.

Why This Is Dangerous

A stealer log that includes emails, passwords, and service URLs is a ready-made attack toolkit. Attackers do not need to guess which platform to target because the URLs tell them exactly where each credential was used. They do not need to crack anything because every password in this dataset is stored in plaintext. The only step remaining is to test the credentials and see which accounts still respond. Even people who changed their passwords after this log was published may still be at risk if attackers moved quickly, and many do.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs (service endpoints and API hosts)

Why This Matters

The 19,148 people in this dataset face direct risk of credential stuffing, account takeover, identity theft, and financial fraud. Password reuse multiplies the danger significantly: if someone used the same password captured here on their email account, banking app, or workplace login, all of those accounts are now exposed from a single infection they may not even know occured. Identity theft is a serious secondary concern. With access to an email account, an attacker can reset passwords across every linked service, intercept two-factor authentication codes, and build a full picture of a victim's financial and personal life. Victims rarely recieve any official notification because the breach originates from the device itself, not from the services involved.

How Stealer Logs Work

MetaCloudVipNew is a label used by a threat actor distributing infostealer-harvested data through Telegram. The underlying data comes from devices infected with malware that silently captures everything a browser stores: saved passwords, autofill data, session cookies, and the URLs of sites the victim logged into. The malware typically arrives through a phishing email, a pirated software download, or a malicious ad. Once installed, it runs invisibly in the background, sending harvested data to the attacker's collection server. The data is then sorted, bundled into log files, and posted or sold on Telegram channels. These logs are entirely seperate from any data held by the services themselves, which is why affected users get no warning from the platforms they use.

Check If You Are Affected

HEROIC's free dark web scanner searches more than 400 billion exposed records, including stealer logs like this MetaCloudVipNew dataset. Enter your email address to find out if your credentials appeared in this upload or in any other known breach. The scan is free, takes seconds, and gives you the information you need to change compromised passwords before an attacker uses them first.

Visit HEROIC.com to run your free scan now.