MetaCloudVipNew 400 PCS Telegram Dump Put 14,956 Cloud Users’ Data on the Dark Web

In June 2025, a threat actor on Telegram distributed a stealer log package labeled MetaCloudVipNew 400 PCS, releasing 14,956 records containing plaintext passwords, email addresses, and URL endpoints tied to cloud service accounts. The sheer volume and the presence of unencrypted passwords make this a high-impact disclosure. Cloud account credentials are particularly valuable to attackers because they often unlock access to storage, communications, and business infrastructure in a single set of logins.

Why This Is Dangerous

Cloud account takeovers are among the most devestating outcomes of a stealer log breach. A single compromised cloud login can expose files, emails, backups, and connected services all at once. Because stealer malware captures credentials at the moment they are typed or saved, the passwords in this dataset were live and in active use when they were harvested. With 14,956 accounts in this single package, the attack surface is significant, and the plaintext format means there is no decryption step standing between the data and a bad actor.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs (cloud endpoint and API host addresses)

Why This Matters

Packages like MetaCloudVipNew circulate widely within Telegram cybercrime communities before spreading to dedicated hacking forums and dark web marketplaces. The "400 PCS" label suggests this was part of a bundled sale of multiple stealer log collections, meaning the credentials were likely distributed to dozens or hundreds of buyers. Each buyer represents an independant attack vector against the same set of victims. Organizations with employees whose cloud credentials appear in this dump face risk of unauthorized access to business systems, data exfiltration, and ransomware deployment.

How Stealer Log Breaches Work

Stealer malware is typically delivered via phishing campaigns, fake software downloads, or malicous browser extensions. Once active on a device, it extracts saved credentials from browsers, password managers, and desktop applications. The collected data is bundled into log files and uploaded to attacker-controlled infrastructure or shared directly through Telegram channels. Buyers then sort and filter the logs to identify high-value targets such as cloud service logins, corporate VPN credentials, and financial accounts.

Check If You Are Affected

HEROIC's free breach scanner checks your email against more than 400 billion exposed records, including stealer log collections like MetaCloudVipNew. If your credentials appear in this dataset or any other known breach, you will see the results instantly. Visit heroic.com to run your free scan and take action before attackers do.