26,068 Pegasus Cloud Credentials Leaked by NEW Pegasus Cloud Stealer Log

In May 2025, DarkHive identified a stealer log file uploaded to Telegram by the threat actor operating as NEW Pegasus Cloud, targeting the Pegasus Cloud platform. The file exposed 26,068 records harvested from compromised endpoints across the United States, containing email addresses, plaintext passwords, and service URLs. Unlike traditional database breaches where attackers must crack hashed credentials, stealer logs contain credentials already in usable form — captured live from infected devices before any encryption could protect them. The breach date was recorded as May 6, 2025.

Why This Is Dangerous

Plaintext passwords from stealer logs are immediately weaponizable. Threat actors who aquire these files do not need to invest in cracking infrastructure; they can begin credential stuffing attacks against major platforms within hours of the log appearing on Telegram. The inclusion of service URLs narrows the attack surface to specific platforms and endpoints, making automated exploitation faster and more precise. For users whose credentials appeared in this Pegasus Cloud log, the risk extends beyond the original platform to any other service where the same email and password combination was used.

What Was Exposed

• Email addresses
• Plaintext passwords
• Service and API host URLs

Why This Matters

Credential stuffing attacks powered by stealer logs have become a primary vector for account takeover fraud. When plaintext passwords are combined with corresponding email addresses and service URLs, attackers can run fully automated campaigns that test thousands of login combinations per minute. Victims who reuse passwords across email, banking, and work accounts face compounding risks as a single exposed credential can unlock multiple accounts. The scale of 26,068 records from a single Telegram upload illustrates how rapidly this data accumulates and circulates in underground channels.

How Stealer Log Infections Work

Infostealer malware is distributed through phishing campaigns, cracked software, and malicious browser extensions. Once installed on a victim's machine, the malware scans for saved passwords, browser cookies, and autofill data before transmitting the collected records to an attacker-controlled server or Telegram bot. The resulting log files are then sorted by platform or geography and shared freely or sold on cybercriminal channels. Many victims never realize thier credentials were stolen because the malware operates silently in the background without causing visible system disruption.

Check If You Are Affected

HEROIC offers a free identity scanner that searches over 400 billion records, including data from stealer logs like Pegasus Cloud PegasusCloud. Visit heroic.com to scan your email address and find out if your information was exposed.