MetaCloudVipNew Users Targeted in 10,838-Record Password Leak

MetaCloudVipNew Stealer Log Exposes 10,838 Records

HEROIC analysts identified a stealer log dataset labeled "MetaCloudVipNew" uploaded to Telegram on November 19, 2025. The dataset contains 10,838 records taken directly from malware-infected devices, including email addresses, plaintext passwords, and the URLs of the accounts those credentials belong to.

Who Is Targeted by This Leak

Anyone whose device was infected by the infostealer malware behind this dataset is directly targeted, since their saved logins were captured and packaged for distribution. Beyond those individuals, the leak also puts at risk anyone who shares a password with someone in the dataset or who reused one of these exact passwords on another account, since attackers routinely test stolen credentials across multiple services.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the associated login pages

Why This Matters

Because the passwords in this leak are stored in plaintext, no cracking or decryption is needed before they can be used. Attackers can immediately attempt to log in to the paired accounts, run the credentials through other popular sites in a credential stuffing attack, or use the email and password pair to impersonate the victim. Reused passwords are especially risky, since a single leaked login can unlock several unrelated accounts.

How Stealer Log Malware Works

Stealer logs come from infostealer malware, malicious software typically delivered through a fake download, phishing link, or pirated software installer. Once it infects a device, it quietly scans the browser and system for saved passwords, autofill data, and active login sessions, then bundles everything into a single file. These files are then sold or shared for free on Telegram channels and dark web forums, exactly how the MetaCloudVipNew dataset surfaced.

Check If You Are Affected

If you are concerned your credentials may be part of this or another leak, HEROIC's free breach scanner checks your email address against a database of more than 400 billion leaked records, including stealer logs like this one. Run a free scan today to find out if your information has been exposed.