How MetaCloudVipNew Stealer Malware Led to 35,895 Stolen Logins

In July 2025, HEROIC analysts detected a stealer log file uploaded to Telegram by an anonymous threat actor carrying 35,895 compromised records tied to MetaCloudVipNew endpoints. The data was collected on July 3, 2025 and includes plaintext passwords, email addresses, and URLs scraped directly from infected machines. Understanding how this file came to exist is key to understanding the risk. This was not a single company being hacked. It was the product of malware running silently on individual devices across the United States, harvesting credentials over time before the entire batch was packaged and distributed on Telegram. For each of the 35,895 people in this file, the process started with a single click on the wrong link.

Why This Is Dangerous

With 35,895 plaintext credential pairs in hand, attackers do not need to do much work. They load the file into automated tools and begin testing logins across banking platforms, email providers, and social media within hours. The presence of URLs in this file makes it even more targeted: criminals know precisely which site each credential belongs to, removing any guesswork. These logs are regularly traded on dark web channels and repackaged into larger credential dumps that persist for years. A file like this one is still being used long after the original upload date.

What Was Exposed

The MetaCloudVipNew stealer log exposed the following data types for each of the 35,895 affected individuals:

• Email Addresses
• Plaintext Passwords
• URLs (site-specific credential mapping showing exactly where each login was stolen from)

Why This Matters

Thirty-five thousand exposed records is not a minor incident. Credential stuffing attacks have occured at scale using far smaller data sets. When attackers cross-reference these credentials with data from other breaches, the risk compounds quickly. A single exposed password reused across multiple accounts can lead to financial fraud, identity theft, unauthorized access to healthcare or government portals, and account lockouts that take weeks to resolve. The people in this file may have no idea their data has been circulating since mid-2025 and that someone has already tried their credentials on a dozen platforms.

How Stealer Logs Work

The process that created this file is seperate from a traditional company data breach. It begins when a user unknowingly installs malware through a phishing link, a fake software download, or a compromised website. The malware, once active, harvests saved credentials from browsers, password managers, and active sessions. It then packages this data into a structured log file and transmits it back to the attacker without the victim ever noticing. These files are bundled in bulk and distributed across Telegram channels where buyers can filter by country, browser, or platform type. The victim never receives a notification. They may not find out until they are locked out of their own accounts or see unauthorized charges they did not recieve a warning about in time to stop.

Check If You Are Affected

HEROIC provides a free breach scanner that searches more than 400 billion exposed records, including stealer log files like this MetaCloudVipNew upload. If your email or password appeared in this Telegram dump or any related breach, you can find out right now. Visit heroic.com to run a free scan and protect your accounts before someone else uses your credentials against you.