One Telegram Upload, 5,298 Stolen Logins: The CVV190_Cloud Stealer Log

In June 2024, HEROIC analysts identified a stealer log named CVV190_Cloud circulating on Telegram, containing 5,298 records harvested directly from infected devices, including email addresses, endpoints, API hosts, and plaintext passwords.

Why This Is Dangerous

This is not a recycled list from an old breach, it is data pulled straight from a victim's own computer by malware. That means the 5,298 credentials inside are more likely to still be active, giving an attacker a direct path into email, financial, or work accounts that the infected user was logged into at the time.

What Was Exposed in the CVV190_Cloud Stealer Log

• Email addresses
• Plaintext passwords
• Associated URLs and endpoints

Why This Matters

Because stealer logs capture whatever was saved in a victim's browser, one infected device can expose logins across multiple unrelated accounts at once. Attackers use this kind of data for direct account takeover and credential stuffing, and the presence of endpoints and API hosts in this log suggests it may also include access points to online services beyond simple website logins.

How a Stealer Log Like This Works

Stealer malware is typically delivered through a phishing email, a fake software crack, or a malicious download, and once installed it silently collects saved passwords, cookies, and autofill data from the victim's browser. That harvested information is compiled into a log, named and organized by the seller, in this case as CVV190_Cloud, before being uploaded to Telegram for sale or distribution.

Check If You Are Affected

Because stealer log data tends to be fresher and more dangerous than older breach dumps, it is worth checking your exposure now. HEROIC's free breach scanner searches more than 400 billion leaked records to tell you if your information has turned up in this or any other stealer log.