Nullcyber Cloud Leak: 6.1 Million Logins Found on Dark Web

In October 2025, HEROIC analysts flagged a massive stealer log named "ULP_Private_8174151_270925_185756_Nullcyber_Cloud," uploaded to a Telegram channel by an anonymous user. The file is enormous, containing 6,105,016 records of email addresses, plaintext passwords, and the exact website URLs each login belongs to.

Picture This: One File, Millions of Open Doors

Imagine a warehouse with more than six million labeled keys, each one taped to a note showing exactly which door it opens and the address of the building. That is essentially what this file is. A criminal does not need to pick a single lock. They simply scroll through the list and start walking into accounts, one after another.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated website URLs

Why This Matters

At this scale, even a small percentage of reused passwords translates into thousands of successful account takeovers. Attackers running automated credential stuffing tools can work through a file like this quickly, opening the door to identity theft and financial fraud for anyone caught up in it.

How Stealer Logs Work

Stealer malware quietly infects devices, often through cracked software or fake installers, then harvests everything saved in the browser: passwords, autofill fields, and session cookies. The results are compiled and named, in this case tagged with a cloud service reference, then shared or sold through private Telegram groups like the one behind this leak.

Check If You Are Affected

With a file this large, the chances of a match are real. HEROIC's free breach scanner checks your email against more than 400 billion exposed records so you can find out immediately whether you were caught up in this exposure.