Inside OTTOMANCLOUD: How Stealer Malware Harvested 958 Passwords

HEROIC analysts found a stealer log file called "OTTOMANCLOUD FREE 150PCS DZ" uploaded to a public Telegram channel on December 13, 2022. The file, drawn from 150 individual infected devices, contains 958 records made up of email addresses, plaintext passwords, and the URLs of the accounts those passwords unlock.

Why This Is Dangerous

The word "free" in this file's name is a warning sign in itself. When stolen credentials are given away rather than sold, it usually means the seller wants the data spread as widely and quickly as possible, putting it in front of far more potential attackers than a paid listing would. Combined with plaintext passwords that need no cracking, this is a low-effort, high-reward target for anyone browsing that Telegram channel.

What Was Exposed in the OTTOMANCLOUD Leak

• Email addresses
• Plaintext passwords
• URLs of the associated login pages or services

Why This Matters

Every record here pairs a real email address with its actual password and the site it unlocks, everything an attacker needs to attempt a direct login. Anyone who reused that password on another site faces the risk of credential stuffing, where attackers automate login attempts across many services at once. That can quickly turn into account takeover, identity theft, or financial fraud.

How a Stealer Log Like This Gets Made

Stealer malware works by infecting a device, then quietly copying saved browser passwords, autofill data, and active login sessions before sending everything back to whoever controls the malware. A batch like "150PCS" represents the combined output of 150 separate infections, each contributing its own set of stolen credentials. Once collected, these logs are commonly packaged and distributed, sometimes sold and sometimes given away free, through channels like Telegram, exactly where HEROIC analysts found this one.

Check If You Are Affected

If you want to know whether your email address appears in this leak or any other, HEROIC's free breach scanner checks your information against a database of more than 400 billion leaked records, including stealer logs like this one. Run a free scan now and change any password you may have reused.